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ABSTRACT 



Education-agency and school staff are legally and ethically 
responsible for safeguarding student information. In addition to federal and 
state laws and regulations, education agencies need policies and procedures 
to guide their everyday information-maintenance operations. This document 
provides examples of policies and procedures as well as guidelines for 
deciding what is needed to ensure the privacy of student information. Section 
1 provides an overview of the issues and discusses important concepts and 
terminology used throughout the document. Section 2 describes federal laws 
protecting the privacy of students that have implications for the maintenance 
and release of student data by state and local education agencies. The third 
section describes appropriate procedures for collecting individual 
information about students. Section 4 explains the management controls and 
policies needed to maintain and use data within the agency or school . It also 
addresses the issue of assessing who in an agency or school has a "legitimate 
educational interest" in specific information about an individual student. 

The fifth section describes procedures for providing access to a student's 
education record by the eligible student or the parent. The final section 
suggests procedures for handling external requests to release information 
from individual school records. The appendices contain the text of key 
federal rules and regulations. A topical index, section summary, an index of 
commonly asked questions, and 22 exhibits are included. Each section includes 
references, an overview, commonly asked questions, and guidelines. (LMI) 
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The primary purpose of this document is to help state and local education agencies and schools 
develop adequate policies and procedures to protect information about students and their families 
from improper release, while satisfying the need for school officials to make sound management, 
instructional, and service decisions. 

The National Forum on Education Statistics (NFES) 1 recognized the significance of such securi- 
ty issues and raised concerns about the privacy of student data being collected, used, and released at 
all levels. In 1994, the Forum completed a report, Education Data Confidentiality: Two Studies. The 
Data Confidentiality Task Force was then established to identify ways to help state education agen- 
cies, school districts, and schools ensure the privacy of education records and to clarify the laws 
that exist for these agencies and the general public. 

This document is produced under the Task Force’s direction. A companion brochure, Protecting 
the Privacy of Student Education Records , has been developed to help educators and the general 
public understand the Family Educational Rights and Privacy Act (FERPA). Appendix A contains a 
copy of the brochure. 

NFES is exploring other issues closely related to the privacy of education records. One of them 
is the security of information technology in education agencies and schools. Guidelines focusing 
primarily on this area will be published in a separate document in early 1998. In addition, the 
Forum is examining the issues of interagency data sharing between education and other service 
agencies at the state and local levels. An issue paper also will be published in early 1998. 



Authorized by the Howkins-Stofford Education Amendments of 1988 (Public Law 100297), NCES established a National 
Cooperative Education Statistics System. This System is intended ta produce and maintain-with the cooperation af the states-unifarm 
and comparable data far education policymaking at the federal, state, and local levels. The work af implementing the System is 
carried aut by NFES, an appointed group that meets twice each year ta debate and approve the findings and recommendations af 
its committees. 
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SECTION 1 : 

A Primer for Privacy 

Suggested audiences: 

✓ State education agency staff 

✓ State or local policymakers 

✓ School district staff 

✓ School administrators or staff 

✓ Program and support services staff 

✓ Technical staff 

✓ Teachers and other school-based support professionals 

OVERVIEW 



Students and their parents entrust schools with their personal 
information with the expectation that this information will be used 
by the schools to serve the needs of the students effectively and effi- 
ciently. School districts maintain and use personal information for a 
variety of educational purposes while students are in school. To pro- 
tect the privacy of the students and their families, agency and school 
staff are legally and ethically responsible for safeguarding student 
information. 

Many federal and state laws and regulations, which must be fol- 
lowed, relate to maintaining and releasing student information. 
However, education agencies need additional policies and procedures 
to guide their everyday operations to maintain the information. Since 
agencies vary in how they collect and maintain information about 
students, the types of policies and procedures needed also will vary. 
This document provides examples of policies and procedures as well 
as guidelines for deciding what is needed to ensure the privacy of 
student information. 

Section 1 presents an overview of the principles related to the 
privacy of student records, explains key concepts, defines important 
terms, and describes the uses and organization of this document. 



PRINCIPLES AND CONCEPTS 



A. Principles Underlying Privacy Protections 

To protect the privacy of families whose children are in school, 
states and the federal government have established strong legal 
statutes to keep private the information in education records that 
schools maintain on students. These laws frame data collection pro- 
cedures, restrict information disclosure, and safeguard the quality of 
the information that school systems routinely collect and maintain. 
All education records about students, whether handwritten or com- 
puterized, are protected by the same privacy regulations. Education 



Strong federal 
statutes protect the 
privacy rights of 
students and their 
families. These 
statutes encompass 
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kept in electronic and 
paper media. 
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personnel are responsible for protecting the integrity and accuracy of 
the information they gather and maintain. Therefore, data managers, 
their staff, and other agency and school personnel, must become 
familiar with the laws that ensure the confidentiality of the records as 
well as the legal concepts underlying those laws. 

Education records contain the administrative reports of students’ 
educational progress, along with any information about past or cur- 
rent use of school-related services, such as special education, social 
work services, or other supplementary educational support. The 
Family Educational Rights and Privacy Act (FERPA), a federal law, 
limits who can see an education record without the consent of the 
student’s parent, and it provides for a parent’s right to see what is 
kept in the records. These two basic features have broad implications 
for the treatment of information about students by teachers, adminis- 
trators, and researchers. 

In addition, schools that participate in a federally assisted school 
nutrition program have personal information about students’ eligibili- 
ty for free and reduced-price school meals or free milk. These pro- 
grams have regulations that are more restrictive than FERPA’s regard- 
ing the disclosure and use of this information. In cases of emergency, 
school officials can obtain data in education records to help students 
or their families get the assistance or care they need. 

In addition to the everyday use of student information by teach- 
ers and administrators, education records are a source of basic data 
used for administrative purposes and policymaking. Statistical infor- 
mation summarized from education records can be an important 
resource for monitoring programs and for evaluating the success or 
failure of education policies. Administrative use of computerized 
records means that education records are used increasingly farther 
from their point of origin. As a result, it has become more complicat- 
ed but no less essential for school officials to be vigilant about pro- 
tecting the confidentiality of records. Those who work with educa- 
tion records have legal and ethical obligations to observe rigorous 
procedures for protecting the privacy of the original information and 
the individuals whose records are involved. 

The Information Infrastructure Task Force of the National 
Information Infrastructure (Nil) recently developed a set of principles 
for providing and using personal information. These principles, sum- 
marized in Exhibit 1-1, provide guidance for those who are drafting 
laws and regulations or creating codes of fair information practices 
and implementation procedures. The principles apply to both the pri- 
vate and public sectors. The guidelines presented throughout this 
document are consistent with the Nil principles. 

B. Key Concepts of Privacy Laws 
and Confidentiality Policies 

Privacy laws lead to establishing regulations that education agen- 
cies and schools must follow so that information about children is 
available only to officials who are authorized to know such informa- 
tion. The laws were passed by the U.S. Congress to ensure parents the 
right of access to information about their children, while allowing 
education officials the flexibility they need to use the information in 
making decisions that serve children well. 
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Federal and state privacy statutes pertaining to students in ele- 
mentary and secondary schools build on concepts of common law 
and privacy guarantees found in the U.S. Constitution. Fundamental 
to the government’s rulemaking about data collection, privacy, and 
appropriate use are three concepts— notification, disclosure, and 
informed consent. 

Notification (according to FERPA) refers to an agency’s responsi- 
bility to inform parents, guardians, or students who are over eighteen 
of the legal basis for compiling data and the limited circumstances 
under which records can be released or disclosed. When school offi- 
cials collect information about families or students, they must 
explain the rationale-or “give public notice”-of the reasons the data 
are being collected. 

Disclosure refers to access, release, or transfer of personal infor- 
mation about individuals. Privacy laws define appropriate or inap- 
propriate information disclosures or releases. According to FERPA, 
data about students may be disclosed without parental consent only 
to school and other education officials who use it to provide educa- 
tional services or to carry out legally specified administrative and sta- 
tistical activities. Any instance in which unauthorized individuals 
see or use private information about students is an inappropriate and 
often illegal disclosure, unless the parent or the student gives consent 
or the law makes such access legal. 

Informed consent involves providing a written account of why 
personal information is requested and how it will be used. In general, 
parents should have the option, without penalty, of agreeing or 
declining to provide the information an education agency or school 
requests. Certain information, however, is required by schools, and- 
parents must provide the information in order for their children to be 
enrolled. Parents’ agreement must be based on an understandable 
explanation of how the information will be used. Once a parent’s 
informed consent is given for a particular purpose or set of purposes, 
the information cannot be “redisclosed”-used by a third party-except 
as originally indicated. FERPA regulations require that prior consent 
be given by parents for the disclosure of information to persons other 
than school officials. 

C. Important Terms 

Education Record 

An education record is a compilation of records, files, docu- 
ments, and other materials that contain information directly related 
to a student and maintained by education agencies or institutions, or 
by individuals acting on behalf of the agencies. According to FERPA, 
a record means any information recorded in any way, including, but 
not limited to, handwriting, print, computer media, video or audio 
tape, film, microfilm, and microfiche. An education record, some- 
times referred to as a student record, may include a variety of details 
about a student such as the date of birth, date of enrollment, bus 
route, immunization history, achievement test scores and grades, 
enrollment and attendance, awards, degrees achieved, and special 
education plans and evaluations. Personal notes by teachers or other 
staff that are not meant to be shared are not part of an education 
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Confidentiality refers 
to your obligation not 
to disclose or 
transmit information 
to unauthorized 
parties. 



Privacy reflects an 
individual’s freedom 
from intrusion. 



Security refers to 
technical procedures 
that ensure only the 
authorized and 
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access to data. 
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transferring, 
disseminating, or 
otherwise 

communicating all or 
any part of any 
individual record 
orally, in writing, or 
by electronic or any 
other means to any 
person or entity. 



record. A record of a student may be maintained in more than one 
location within an agency or school (e.g. , enrollment record in the 
school’s administrative office and health information in the school 
health clinic). 

Information included in an education record is collected primari- 
ly from the student (or family members), teachers, and other school 
staff. It may also be collected from other sources outside the school, 
such as health care providers or testing companies. Personal informa- 
tion about students is a vital resource for teachers and school staff in 
planning responsive education programs and services-designing indi- 
vidual education plans; scheduling students into appropriate classes; 
planning school bus routes; and completing reports for local, state, 
and federal authorities. In emergencies, the information is readily 
available to school officials to assist students and their families. A 
limited amount of this information, as defined by the school district 
or the state, makes up a student’s permanent records or transcripts. 

Confidentiality 

Confidentiality refers to your obligation not to disclose or trans- 
mit information to unauthorized parties. Confidentiality extends to 
information about either individuals or organizations. In schools, dis- 
tricts, or state education agencies, that usually means establishing 
procedures that limit access to information about students or their 
families. This access extends to the school officials who work directly 
with the students, agency representatives who serve as evaluators or 
auditors, or individuals who act on behalf of authorized education 
officials. 

Privacy 

Privacy is a uniquely personal right that reflects an individual’s 
freedom from intrusion. Protecting privacy means ensuring that infor- 
mation about individuals is not disclosed without their consent. A 
student’s right of privacy is violated when personal information is 
disclosed to others without consent, or when he or she is being asked 
for personal information by others who have no legal basis to do so. 
While confidentiality, defined above, refers to restricting disclosure of 
information to authorized individuals only, privacy refers to protec- 
tion from personal intrusion. 

Security 

Security refers to technical procedures that ensure only the autho- 
rized and intended parties have access to data. 

Disclosure (or Release) 

Disclosure includes permitting access to, revealing, releasing, 
transferring, disseminating, or otherwise communicating all or any 
part of any individual record orally, in writing, or by electronic or 
any other means to any person or entity. The terms disclosure and 
release are used interchangeably in this document. Throughout this 
document, the information being disclosed or released pertains to 
students and/or their families. 
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Parent or Eligible Student 

FERPA grants parents the rights to review, request amendment to, 
and release education records. A parent means a natural or adoptive 
parent, a legal guardian, or an individual acting as a parent in the 
absence of the parent or guardian. These rights transfer to eligible stu- 
dents when they reach eighteen or when they attend a postsecondary 
education institution. However, parents can still have access if the 
eligible student is a dependent for tax purposes. When used in this 
document, the term parent refers to the person who is given the rights 
described in FERPA. 

Agency or School 

Throughout this document, agency or school refers to the entity 
that collects, maintains, uses, and releases information from educa- 
tion records. This entity may be a state education agency, school dis- 
trict, public or private school or institution, intermediate education 
unit, or an institution to which funds have been available to adminis- 
ter an educational program for students with disabilities or school-to- 
work programs administered on behalf of an education agency. 

ABOUT THE DOCUMENT 

We developed the guidelines presented in this document by using 
information obtained from a variety of sources and representing the 
best practices currently used in the relevant subjects. In preparing 
this document, we reviewed published books and reports, as well as 
policies and procedures adopted at the national, state, district, and 
institutional levels. 

Possible Users of This Document 

Many members of the education community have access to confi- 
dential information. This document addresses the need for the mem- 
bers of the education community to understand their legal responsi- 
bilities and to develop procedures to maintain the privacy of student 
records. Persons who may use the information in this document 
include: 

State education agency staff need to understand the legal 
requirements and implement proper management procedures and 
controls at the state level when they collect personally identifiable 
student information. This document can help state education agency 
staff to identify ways to ensure that data providers and users are 
informed of their rights and responsibilities when handling personal- 
ly identifiable as well as aggregate data. State education agency staff 
also have a responsibility to advise school and school district staff on 
proper policies and procedures to ensure privacy. 

State or local policymakers need to understand the legal require- 
ments and identify the areas in which rules, regulations, policies, or 
guidelines are needed. 

School district staff who maintain student records or data need 
to understand the legal requirements of federal and state laws and 
local regulations that protect the privacy of the records. They must 
develop proper policies that specify the roles of staff and the steps 
that are required to make the policies operational. 



FERPA defines parent 
as a natural or 
adoptive parent, a 
legal guardian, or an 
individual acting as a 
parent in the absence 
of the parent or 
guardian. These 
rights transfer to 
eligible students when 
they reach eighteen or 
when they attend a 
postsecondary 
education institution. 



An agency or school 
refers to the entity 
that collects, 
maintains, uses, and 
releases information 
from education 
records. 
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School administrators or staff who maintain files about students 
in their schools need to know how to handle requests for information 
about students and how to restrict access to student records. They 
also need to notify parents or eligible students of their rights under 
FERPA. 

Program and support services staff at the district or state level 
need to understand their rights to see personally identifiable informa- 
tion about students as well as their responsibilities to share informa- 
tion only with appropriate persons. 

Technical staff need to plan for the appropriate technical config- 
urations to manage the security of the information system effectively. 

Teachers and other school-based support professionals who 

receive numerous formal or informal requests from colleagues or out- 
siders for information about their students need to know that policies 
are in place to ensure the appropriate maintenance and release of per- 
sonally identifiable data. 

Parents, researchers, and others outside the education community 
could use this document to learn more about the kinds of safeguards 
and restrictions that need to be implemented in schools and other 
places where student data are maintained. However, we have focused 
the information in this document on education agencies and staff. 

Throughout this document, we identify the intended audiences at 
the beginning of each section. Readers may select the appropriate 
contents that address their specific interests and needs. 

Organization and Format of the Document 

We have divided this document into six sections. Sections 2 to 6 
identify the intended audience(s) and list commonly asked questions 
for which detailed answers may be found in the text. The text dis- 
cusses general guidelines and provides examples of effective prac- 
tices, sample forms, and references to other sources. 

Section 1 : A Primer for Privacy 

Section 1 provides an overview of the issues and discusses 
important concepts and terminology used throughout the document. 
The section also presents the organization and contents of the docu- 
ment. 

Section 2: Summary of Key Federal Laws 

Section 2 describes federal laws protecting the privacy of stu- 
dents that have implications for the maintenance and release of stu- 
dent data by state and local education agencies. You are encouraged 
to identify relevant state laws and local regulations that also apply. 

Section 3: Protecting the Privacy of Individuals during the 
Data Collection Process 

Section 3 describes appropriate procedures for collecting individ- 
ual information about students. 

Section 4: Securing the Privacy of Data Maintained and Used 
within an Agency 

Section 4 describes the management controls and policies needed 
to maintain and use data within the agency or school. This section 
addresses the issue of assessing who in an agency or school has a 
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“legitimate educational interest” in specific information about an 
individual student. 

Section 5: Providing Parents Access to Their Child's Records 

Section 5 pertains to procedures for providing access to a stu- 
dent’s education record by the eligible student or the parent. 

Section 6: Releasing Information Outside an Agency 

Section 6 suggests procedures for handling external requests, 
including the public, researchers, and other service professionals, to 
release information from individual student records. 

The Appendices contain the text of key federal rules and regula- 
tions. The appendices, which immediately follow the text, provide 
the complete text of key federal rules and regulations discussed in 
this document. We encourage you to search for and include in this 
section your states’ laws or statutes that further govern the privacy of 
education records. 

You can find other resources and tools to use and help apply this 
document the end. The Tools section includes resources to use and 
help apply this document and contains: 

• An abbreviated topical index will help you locate your topics of 
interest. 

• Highlights for each section summarize key points for easy refer- 
ences or for other uses such as training. 

• A list of commonly asked questions will guide you to find 
answers in Sections 2 to 6. 
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EXHIBIT 1-1 

A Summary of 

Privacy and the National Information Infrastructure: 
Principles for Providing and Using Personal Information 1 



I. General Principles for All National 
Information Infrastructure (Nil) 
Participants 

A. Information Privacy Principle 

Personal information should be acquired, dis- 
closed, and used only in ways that respect an 
individuals privacy. 

8. Information Integrity Principle 

Personal information should not be improperly 
altered or destroyed. 

C. Information Quality Principle 

Personal information should be accurate, timely, 
complete, and relevant for the purpose for which 
it is provided and used. 

II. Principles for Users of Personal 
Information 

A. Acquisition Principle 

Information users should: 1) assess the impact on 
privacy in deciding whether to acquire, disclose, 
or use personal information; and 2) acquire and 
keep only information reasonably expected to 
support current or planned activities. 

8. Notice Principle 

Information users who collect personal informa- 
tion directly from the individual should provide 
adequate, relevant information about: 1) why 
they are collecting the information; 2) what the 
information is expected to be used for; 3) what 
steps will be taken to protect its confidentiality, 
integrity, and quality; 4) the consequences of pro- 
viding or withholding information; and 5) any 
rights of redress. 

C. Protection Principle 

Information users should use appropriate techni- 
cal and managerial controls to protect the confi- 
dentiality and integrity of personal information. 



information Infrastructure Tosk Force: 1995. 



D. Fairness Principle 

Information users should not use personal informa- 
tion in ways that are incompatible with the indi- 
viduals understanding of how it will be used, 
unless there is a compelling public interest for 
such use. 

E. Education Principle 

Information users should educate themselves and 
the public about how information privacy can be 
maintained. 

III. Principles for Individuals who Provide 
Personal Information 

A. Awareness Principle 

Individuals should obtain adequate, relevant infor- 
mation about: 1) why the information is being 
collected; 2) what the information is expected to 
be used for; 3) what steps will be taken to pro- 
tect its confidentiality, integrity, and quality; 4) the 
consequences of providing or withholding infor- 
mation; and 5) any rights of redress. 

8. Empowerment Principle 

Individuals should be able to safeguard their own 
privacy by having: 1) a means to obtain their 
personal information; 2) a means to correct their 
personal information that lacks sufficient quality to 
ensure fairness in its use; 3) the opportunity to 
use appropriate technical controls, such as 
encryption, to protect the confidentiality and 
integrity of communications and transactions; and 
4) the opportunity to remain anonymous when 
appropriate. 

C. Redress Principle 

Individuals should, as appropriate, have a means 
of redress if harmed by an improper disclosure or 
use of personal information. 
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Summary of Key Federal Laws 



Suggested audiences: 

✓ State education agency staff 

✓ State or local policymakers 
%/ School district staff 

✓ School administrators or staff 

OVERVIEW 



Education agency administrators and parents share a common 
interest in ensuring that personal information about children in ele- 
mentary and secondary schools is kept confidential. Many are 
unaware of the protection offered by state and federal laws. In this 
section, we inform administrators and parents about how federal laws 
protect information maintained in school and education agency 
records. The guidelines in this section offer practical information to 
education agency personnel and policymakers on developing proce- 
dures that will work for families and schools. 



This material reflects only the broad outline of federal privacy 
policy requirements. We describe federal policy principles, many of 
which are supplemented by additional state statutes or local regula- 
tions. We caution that our interpretations are not legally binding, and 
we advise readers to direct specific questions either to local and state 
legal experts or to the appropriate federal government offices. 



COMMONLY ASKED QUESTIONS 



Q, What agencies are subject to federal laws on the privacy of 
education records? 

A. Education agencies and institutions that collect and maintain 
education records are subject to federal privacy laws if they 
receive funds from the U.S. Department of Education. If 
information derives from an education record or is maintained in 
the record , federal as well as state and local privacy rules apply. 
See Section 2, Guidelines A. 



Q. Do privacy assurances differ across federal education programs? 

A. Privacy components of laws are administered by federal 
agencies other than the U.S. Department of Education, and these 
may be applicable to programs directed in schools. However, the 
Family Educational Rights and Privacy Act (FERPA) is a 
comprehensive law that applies broadly to information collected in 
public agencies or schools that receive federal education funds. 
Thus, FERPA applies to information collected and maintained by 
most public elementary, secondary, and postsecondary education 
institutions and by some private institutions in this country. See 
Section 2, Guidelines A. 
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Q. Are individuals liable for penalties if they do not adhere to the 
requirements of FERPA? 

A. No, not typically . Institutions receiving funds from the U.S. 
Department of Education are legally responsible for complying with 
these laws . Individual liability would depend on state laws and 
local policies . See Section 2, Guidelines Al. 

Q. What do state and local education agency personnel need to 
know about federal privacy laws pertaining to education records? 

A . Strong federal laws protect the privacy of education records in 
schools . Individuals who work with education records in agencies 
or schools are responsible for knowing the privacy regulations that 
apply to their work . Agency administrators need to understand 
federal and state laws, as well as local policies, that govern parent 
access to records and restrict inappropriate disclosure of 
information about students and their families. See Section 2, 
Guidelines A and B . 

Q. About which federal student records laws do school district or 
state education agency administrators need to be informed? 

A. FERPA and the Protection of Pupil Rights Amendment (PPRA) 
are the two major laws governing the protection of education 
records and student and family privacy The other key laws with 
specific federal regulatory requirements pertaining to schools are 
the National School Lunch Act and the Individuals with Disabilities 
Education Act See Section 2, Guidelines B to E. 

t — _ — - — - • - -i 

Q. What are the FERPA restrictions on matching data from student 
information files with data from other agency files? 

A. FERPA generally prohibits data matches without parent consent 
except to (1) officials in other schools or school systems where a 
student intends to enroll; (2) authorized state or federal education 
representatives; and (3) organizations that are conducting approved 
studies on behalf of an education agency Under certain 
circumstances, school officials can make cooperative data sharing 
arrangements, but they cannot reveal personally identifiable 
information . See Section 2, Guidelines B5. 

Q. What are the responsibilities of state education agencies for 
providing parent or eligible students access to education records? 

A. A state education agency must provide parents and eligible 
students with access to education records the agency maintains. 
Although these agencies are not required to establish a written 
policy, they are obligated to honor rights of access and to restrict 
disclosure of inf ormation except to authorized individuals. See 
Section 2, Guidelines B6. 
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GUIDELINES 



A. Privacy-Related Laws That Apply to Agencies 
and Schools 



Al. Which education agencies or institutions must 
adhere to federal education privacy laws? 

Education agencies and institutions that receive funds from the 
U.S. Department of Education must adhere to federal privacy laws 
pertaining to education records of students. These generally include 
public elementary and secondary schools, school districts, intermedi- 
ate education agencies, and state education agencies or their repre- 
sentatives. Most private and public colleges and universities are also 
subject to federal privacy laws because they receive federal funds 
from the U.S. Department of Education. However, because few private 
elementary and secondary schools receive federal funds directly, they 
are rarely subject to these privacy restrictions. 

State or local education agencies that conduct programs adminis- 
tered by other federal agencies-the U.S. Departments of Agriculture, 
Health and Human Services, or Labor, for example-may also be 
required to meet confidentiality provisions of applicable statutes. 



A2. Which federal laws directly affect data that 
education agencies collect and maintain? 



A number of federal laws govern data collections by schools, dis- 
tricts, and state education agencies, and two of those laws apply most 
broadly: FERPA and PPRA. Exhibits 2-1 and 2-2 contain fact sheets 
describing FERPA and PPRA. Together, the two laws have far-reach- 
ing legal implications for state and local policies and procedures that 
guide three aspects of education agencies’ data collection activities: 



• Rights of a parent to review and to seek to amend records adminis- 
tered by state or local education agencies or their representatives 

• Procedures by which education records can be released and pro- 
tected 

• Rights of parents to review and, under some circumstances, to 
provide consent for their child’s participation in surveys, analy- 
ses, or evaluations that are administered by state or local educa- 
tion agencies or their representatives 

Privacy protection under FERPA is generally incorporated into 
laws authorizing federal education programs. Thus, FERPA and PPRA 
requirements apply to programs such as Title I, Migrant Education, 
Safe and Drug Free Schools and Communities, School-to-Work 
Opportunities, Education of Neglected and Delinquent Youth, Even 
Start, and Even Start Family Literacy. Similarly, most states include 
the core privacy protection of FERPA in their education legislation; in 
many cases they extend and strengthen this protection. 



In addition to FERPA and PPRA, other federal laws affect school, 
district, or state education agency data collection, maintenance, and 
disclosure procedures. Among them are: 



Federal privacy laws 
apply to education 
agencies, institutions, 
and schools that 
receive federal funds 
from the U.S. 
Department of 
Education. 



The Family 
Educational Rights 
and Privacy Act 
establishes broad 
privacy protections 
for education records. 



The Protection of 
Pupil Rights 
Amendment gives 
parents rights to 
review their child’s 
records. 



Other federal laws, 
such as IDEA, affect 
data collection, 
maintenance, and 
disclosure 
procedures. 
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• The Individuals with Disabilities Education Act (IDEA), which 
applies to the education records covered by this law. However, 
IDEA release and disclosure requirements are substantially identi- 
cal to those in FERPA. 

• The Federal Drug and Alcohol Patient Records Confidentiality 
Law (42 CFR), which applies to the services and treatment of 
records pertaining to students who receive assistance from pro- 
grams administered by the Substance Abuse and Mental Health 
Services Administration. 

• The National School Lunch Act, which restricts the release of eli- 
gibility and services information about students and families who 
participate in the federal free and reduced-price lunch program. 

• The Paperwork Reduction Acts of 1980 and 1995, which include 
rules that restrict what the federal government can ask state and 
local agencies to collect for the federal government. 

Two other federal laws, the Freedom of Information Act (FOIA) of 
1966 and the Computer Matching and Privacy Protection Act of 1988 
do not apply to the education records maintained by schools or state 
education agencies because they pertain only to data the federal gov- 
ernment collects directly from individuals. However, many states 
have passed FOIA or other privacy laws very much like the federal 
statutes that may apply to the information schools collect. When 
agencies or schools establish data policies and procedures, they 
should consult state statutes on these matters, as well as the federal 
requirements. 

The Federal Policy for the Protection of Human Subjects, admin- 
istered by sixteen federal departments and agencies, establishes pro- 
cedures for protecting the rights of individuals-including students 
and families-who participate in federally sponsored research activi- 
ties and programs. This statute establishes the preliminary rules 
researchers must follow when they conduct studies sponsored by fed- 
eral agencies. Although these regulations may apply to data collec- 
tions by schools, FERPA establishes additional basic disclosure 
restrictions that guide the treatment of any information collected in 
schools-whether the activity is sponsored by an education or other 
agency or individual-if the information either derives from education 
records or is maintained in those records for any period of time. 



FERPA grants 
parents, and students 
over eighteen, access 
to education records 
and restricts 
disclosure of this 
information without 
their consent. 



B. Privacy Protection under FERPA: Responsibilities 
of Agencies and Schools 

The U.S. Congress passed FERPA in 1974 to protect student and 
family privacy. Also known as the Buckley Amendment, FERPA 
grants parents certain rights of access to their children’s education 
records and restricts disclosure of information from those records 
without their consent. It also allows parents and eligible students to 
amend records they believe to be inaccurate or misleading. 
Appendices B to D contain the original FERPA regulations, subse- 
quent changes, and the most recently issued regulations. The original 
FERPA statute and its amendments are incorporated in the U.S. Code 
(20 USC 1232g). The Federal Register (34 CFR Part 99) contains regu- 
lations for administering the law. 
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This section reflects the 1996 revision of FERPA regulations that 
resulted from modifications to FERPA made in the Improving 
America’s Schools Act of 1994. The U.S. Department of Education 
published revised regulations in the Federal Register on November 
21, 1996 (pp. 59291-59298), to ensure greater flexibility in imple- 
menting the privacy laws pertaining to student records. See 
Appendix D for a copy of these revised regulations. 

The law regards as an education record most information that 
teachers, school administrators, and education officials maintain 
about students in a tangible format, whether in electronic, photo- 
graphic, or paper files. Regardless of where the information about stu- 
dents originates, if it is maintained by schools or education agencies, 
protecting its privacy is governed by FERPA. School districts, schools 
or state education agencies, if asked, must comply with parents’ or 
eligible students’ requests for access and review. 

FERPA requires school districts-but not state education agen- 
cies-to notify parents and eligible students annually of their rights 
under FERPA. Among the changes in FERPA that resulted from the 
1996 regulations was the removal of requirements for districts to 
adopt written policies pertaining to FERPA. Although local written 
policies are no longer required, regulations continue to encourage 
districts to develop privacy policies, but they grant agencies the dis- 
cretion to adopt local implementation procedures and policies. 
Because state or local privacy protection laws or policies may supple- 
ment or refine FERPA, many state and local education agencies estab- 
lish written policies to ensure the law will be applied uniformly. 

Bl. FERPA Defines Protected Education Records 

FERPA defines education records as information: 

• Directly related to a student, specifically any information record- 
ed in any way, including, but not limited to, handwriting, print, 
computer media, video or audio tape, film, microfilm, and micro- 
fiche 

• Maintained by education agencies or institutions, or by parties 
acting for the agency or institutions (e.g., special education 
schools and health or social services institutions) 

Records pertaining to special education students are subject to 
the same FERPA requirements as all other student records. Education 
records include but are not limited to: 

• Family information, such as name and address of the student, 
parent or guardian, emergency contact information, date of birth, 
number of siblings, date and place of birth 

• Personal information, such as an identification code, social secu- 
rity number, picture, or list of personal characteristics that would 
make it easy to identify a student 

• Grades, test scores, courses taken, academic specializations and 
activities, and official letters about a student’s status in school 

• Test records, answer sheets (including written responses to per- 
formance assessments and portfolios), and records of individual- 
ized education programs 

• Special education records 



Districts’ written 
privacy policies 
ensure the uniform 
application of FERPA. 



FERPA protects most 
information collected 
by schools about 
students. However, 
teachers’ informal 
notes, records of 
school-based law 
enforcement units, 
and employment 
records do not fall 
under the jurisdiction 
of this law. 
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Directory information 
of individual students 
may be released 
without prior consent. 
However, school 
districts must give 
public notice of what 
is considered in this 
category. 



• Disciplinary records established and maintained by school offi- 
cials 

• Medical and health records that the school collects and maintains 

• Documentation of schools attended, courses taken, attendance, 
awards conferred, and degrees earned 

• Video tape recordings of individuals or groups of students 

A school district may establish policies that list the types and 
locations of education records with a schedule of fees (which must be 
reasonable) that are charged for duplicating records. Agencies may 
not, however, charge a fee to search or to retrieve education records. 

Some information about students is not considered an education 
record and is not subject to access or disclosure rules under FERPA: 

• Handwritten notes by teachers, supervisors, school counselors, 
and administrators, which may be used by substitute teachers or 
other replacement personnel 

• Records created by law enforcement units of schools or education 
agencies that are maintained separately from education records 

• Employment records about a student who is employed by a 
school, education agency or institution 

• Information obtained about individuals after they are no longer 
students 

Another type of information is not subject to access or disclosure 
rules under FERPA. FERPA allows school systems to establish a poli- 
cy that designates some types of information as directory informa- 
tion-the portion of the education record that would not generally be 
considered harmful or an invasion of privacy if disclosed. Local edu- 
cation agency definitions of directory information may vary, but they 
generally include a student’s name and school activities, family mem- 
bers’ names, addresses, and telephone numbers. Some school districts 
also include as directory information the biographical materials 
found in school yearbooks, such as video tapes and pictures of stu- 
dents, participation in various extracurricular activities, the degrees 
and awards received, and the names of previous schools attended. 

The height and weight of athletes may also be included as directory 
information. Once notice of directory information is given, school 
officials can distribute the information to anyone who requests it 
inside or outside the school. 

If a school district has a policy for disclosing directory informa- 
tion, it must give public notice of what is considered in this category 
and indicate that parents may refuse to allow the agency to designate 
any or all of their child’s record as directory information. The law 
requires the notification to specify the period of time in which par- 
ents must inform the school or district of any directory information 
whose release they disallow. Such notification can occur through a 
school newsletter, student handbook, or some other publication that 
parents reasonably can be expected to receive. 

B2. Local Education Agencies-Not State Agencies-Must 
Give Public Notice of Rights under FERPA 

FERPA regulations require school districts and institutions acting 
in their behalf to give annual notification to parents and eligible stu- 
dents of their rights to review education records and to request cor- 
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rections of records they perceive to be inaccurate. Exhibit 2-3 pre- 
sents a model privacy notification. These regulations apply to the 
education records maintained in any school, education agency, or 
institution representing an education agency. FERPA applies to all 
educational institutions, defined as agencies that provide: 

• Educational services or instruction, or both, to students 

• Administrative control or services to public elementary or sec- 
ondary schools or postsecondary institutions 

The U.S. Department of Education does not require local educa- 
tion agencies to notify parents or eligible students individually of 
their rights, but agencies must provide notice where it is likely to be 
seen. FERPA regulations regarding records access apply to state and 
local agencies, but only local agencies must give annual notification 
of rights under FERPA. The annual notification must inform parents 
they have the right to: 

• Inspect and review their child’s record 

• Seek to amend the record if they believe the record to be inaccu- 
rate, misleading, or otherwise in violation of their child’s rights 

• Consent to disclosures of personally identifiable information in 
the record, with certain exceptions authorized by FERPA 

• File a complaint with the U.S. Department of Education concern- 
ing the district’s failures to comply with the requirements of 
FERPA 

Parents’ access to records is limited to information about their 
own child. In cases where an education record contains information 
about more than one child, the information must be separated so that 
parents do not have access to the records of any child other than their 
own. 

FERPA requires local agencies to provide their annual notification 
in a manner that “effectively informs” those who have a disability or 
who speak a primary or home language other than English. Methods 
for notifying parents may include either providing notice in alterna- 
tive formats such as audio tape, braille, computer diskette, or large 
print, or translating information into the native language of request- 
ing parents. 

State education agencies are not required by FERPA to have writ- 
ten policies about the rights afforded to the parents of eligible stu- 
dents; however, the law does require state education agencies to let 
parents and eligible students inspect and review records maintained 
by the state education agencies. Examples of records state education 
agencies may maintain are students’ state test records, records of spe- 
cial education evaluation or treatment, or records of participation in 
school-to-work programs. 

B3. Parents and Eligible Students May Inspect and 
Review Education Records 

FERPA also grants records inspection and review rights to eligible 
students who are over eighteen or who have graduated from high 
school and are attending a postsecondary education institution. A 
student under eighteen who is still in high school but is also taking 
college courses has access to records held by the college, but access 
rights to records held by the high school still belong to the parents. 



The U.S. Department 
of Education does not 
require local 
education agencies to 
notify parents or 
eligible students 
individually of their 
rights, but agencies 
must provide notice 
where it is likely to 
be seen. 



Parents and eligible 
students may inspect, 
review, and request to 
amend education 
records. 
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FERPA restricts 
release of information 
without prior consent. 
However, FERPA 
allows disclosure if 
officials have a 
legitimate educational 
interest in gaining 
access to the 
information. 



Parents who claim students as dependents for income tax purposes 
may be given access to school records, even if the rights under 
FERPA have transferred to the student. 

Parents and eligible students may request an explanation or inter- 
pretation of their education records, whether these records are held 
by schools, agencies, or representatives of educational institutions. 
The agency must respond to requests to review education records 
within forty-five days of the inquiry. If parents or eligible students 
believe a record is inaccurate or misleading, they may petition for the 
record to be amended or changed. The education agency must decide 
within a reasonable period of time if the request to change the record 
is consistent with the agency’s own assessment of the record’s accura- 
cy. The agency cannot destroy records if there is an outstanding 
request to inspect or review them. 

If a request to amend records is denied, the applicant can subse- 
quently appeal the decision in a hearing conducted by the education 
agency. After the hearing, a parent or eligible student who continues 
to disagree with the contents of a record can insert an explanation of 
the objection into the official record, and that explanation must 
remain with the record as long as it is held by the agency. 

FERPA gives either a parent or a legal guardian equal rights to 
review an education record unless there is evidence of a court order 
or a law revoking these rights. A parent refers to a natural or adoptive 
parent, including non-custodial or foster parents, a legal guardian, or 
an individual acting in the parent’s absence. The law grants parent 
rights to foster parents acting on behalf of the child. Agencies or 
schools can require parents to verify their relationship with a child 
before providing access to records. Further specification of eligibility 
requirements is not stipulated in the federal law but can be detailed 
in state laws or local policies. 

B4. FERPA Restricts Release of Information without 
Prior Consent 

Certain additional restrictions apply to records disclosure proce- 
dures. Without consent of the parent or eligible student, education 
records can be disclosed only to school officials designated as having 
a “legitimate educational interest.” The law leaves to the district the 
authority to define the criteria for determining the legitimacy of an 
educational interest, which generally includes situations where offi- 
cials need to review education records to fulfill their professional 
responsibilities. This includes access to records by teachers, coun- 
selors, and administrators who routinely work with students. The fol- 
lowing lists some example situations in which legitimate educational 
interest prevails: 

• To perform education- or discipline-related tasks in connection 
with a student 

• To provide services to a student or a student’s family such as 
emergency health care, counseling, or school or job placement 

• To perform administrative or other educational responsibilities 
prescribed by the agency or school 

If an educational agency or institution has a policy of disclosing 
education records to officials considered to have a legitimate educa- 
tional interest, it must also give annual notification that explains the 
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criteria for determining who constitutes a school official and what 
constitutes a legitimate educational interest. Depending on the policy 
defined locally, school officials might include any or all of the follow- 
ing: 

• A school administrator, supervisor, instructor, or support staff 
(including health or medical staff or law enforcement unit per- 
sonnel) 

• A school board member with an authorized reason to review a 
record 

• A person or company with whom the district has contracted to 
perform a special task (e.g., an attorney, auditor, medical consul- 
tant, or therapist) 

• A parent or student serving on an official committee, such as a 
disciplinary or grievance committee, or assisting another school 
official in performing required tasks 

Because these officials, acting on behalf of students, have a need- 
to-know, they can usually access information without seeking consent. 

Disclosure of information to an individual or agency outside the 
school, school district, or state education agency-a third party-gener- 
ally is not allowed without prior consent of a parent. Under certain 
circumstances (e.g., government-required audits, evaluations, or court 
orders), a district can release records without approval of the parent, 
but it must make clear the criteria for determining which institution 
or agency representatives may receive such information and under 
what conditions. FERPA stipulates that records disclosure without 
consent of the parent is permissible for the following individuals and 
organizations: 

• Officials in another school, school system, or postsecondary edu- 
cation institution where the student intends to enroll. Such 
releases must be reported to the parent or eligible student unless 
the release either is initiated by one of them or is specified by 
local policy. 

• The U.S. Secretary of Education, authorized representatives of the 
Comptroller General of the United States, and state and designat- 
ed local education authorities. 

• Institutions to which students apply to receive financial aid to 
determine eligibility, amount of aid, conditions of aid award, and 
enforcement of award terms and conditions. 

• Accrediting organizations to carry out their functions. Release is 
allowed to accrediting organizations only if the resulting studies 
do not identify any particular student and if all personal identifi- 
cation is destroyed. 

• Organizations conducting studies on behalf of education agencies 
or institutions, including those that develop or administer tests, 
administer student aid programs, or evaluate programs for 
improving instruction. 

• Agencies in the state’s juvenile justice system and in response to 
court orders or subpoenas, as specified in the state’s laws. 

• Appropriate parties in a health or safety emergency. 

• State and local officials or authorities if specifically required by a 
state law that was adopted before November 19, 1974. 
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FERPA restricts 
records matching and 
redisclosures of 
private information to 
third parties. It also 
established penalties 
for inappropriate 
redisclosure. 



In 1996, new 
provisions clarified 
FERPA, making it 
easier for school 
officials to 

understand the law’s 
central requirements. 



When a record is disclosed in the types of situations indicated 
above, the originating agency must note in the record the names of 
the parties who received the information and an explanation of the 
legitimate educational interest under which the record was disclosed. 
FERPA requires agencies or schools to account for all instances of 
education records release, indicating the reasons the information was 
provided and who received it. These explanations must be recorded 
in a student’s record and maintained there until the agency destroys 
the record. 

B5. Records Matching and Redisclosure to Third Parties 

FERPA generally prohibits matches of computerized education 
records held by local or state education agencies with data from other 
agencies. These prohibitions apply broadly, to data sharing about spe- 
cial education programs, evaluating or monitoring the use of federal 
funds, or coordinating interagency social service assistance to stu- 
dents and families. 

Beginning in 1994, the U.S. Congress established penalties for 
inappropriate release of personally identifiable information from edu- 
cation records by a third party. An agency or institution cannot allow 
that third-party access to personally identifiable information from 
education records for at least five years. 

However, cross-agency cooperative use of information from edu- 
cation records is an area of developing law and interpretation that 
experts are continually reexamining. States and local government 
agencies, along with schools, are seeking means to reduce fragmenta- 
tion and duplication across service systems. Occasionally, intera- 
gency partnerships can be formed to exchange information about 
individual students in a manner that provides useful information but 
retains the anonymity of an individual student. Those who have 
experimented with such interagency partnerships are overcoming 
legal obstacles to collaboration without threatening the confidentiali- 
ty of students who receive services. We address this topic in greater 
detail in Section 6. 

B6. Implications of Other 1996 FERPA Regulations 

In addition to reducing the requirements for local education agen- 
cies to have written FERPA policies, the 1996 regulations implement- 
ing the 1994 Improving America’s Schools Act (IASA) clarified sever- 
al other components of FERPA. The regulations: 

• Remove certain requirements about the annual notification of pri- 
vacy rights, simplifying and making it easier to understand the 
central requirements of FERPA. 

• Establish a standard for giving annual notification to parents and 
eligible students that strikes a balance between placing a minimal 
requirement on education agencies and institutions and ensuring 
that parents and eligible students are effectively informed of their 
rights under FERPA. 

• Maintain the previously established forty-five day period for 
responding to requests to inspect records. 

• Require state education agencies to comply with the access provi- 
sions of FERPA, but not with the notification provisions. State 
education agencies are not required to give notice about their 
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policies because the statute authorizing FERPA did not grant the 
U.S. Department of Education authority to establish regulations 
for states. 

• Clarify that nothing in FERPA, under certain circumstances, pre- 
vents schools from maintaining and disclosing specific informa- 
tion regarding disciplinary actions taken against students for con- 
duct that poses a risk to the safety of the student, other students, 
or other members of the school community. 

• Give schools and education agencies the discretion to determine 
the circumstances under which it is appropriate to disclose infor- 
mation and what information will be released about disciplinary 
actions taken against students whose behavior posed risks. 

• Grant schools and education agencies the flexibility to determine 
whether an education record of a juvenile may be released to 
authorities in the juvenile justice system without the prior writ- 
ten consent of the parent. 

• Allow officials to withhold information from parents if a court 
order or subpoena related to law enforcement specifically states 
that its existence should not be revealed to a parent or student. 

These and other new provisions of the law should be closely 
reviewed by privacy experts within school districts and state educa- 
tion agencies for their specific applicability to individual cases. 

C. U.S. Department of Education-Funded Surveys 
and Studies 

PPRA, amended in 1994 by the Goals 2000: Educate America Act, 
specifies that information collected from students through surveys, 
research, analyses, or evaluations funded by the U.S. Department of 
Education must be available for parents to review. If parents ask, the 
surveys or evaluation materials must be made available for review. 
Surveys administered under the auspices of federally sponsored pro- 
grams that are conducted in elementary or secondary schools fall 
within this law. 

Like FERPA, PPRA applies to programs administered by the U.S. 
Department of Education. PPRA grants parents access to information 
that local or state education agencies collect from students under the 
auspices of federally funded activities. Agencies that collect informa- 
tion from students must explain to parents the rights that PPRA 
affords them. Information to parents must be readily understood by 
parents with disabilities or whose home language is not English. 

PPRA protects the rights of students and their parents in two 
ways. First, it requires that parents have the opportunity to review 
certain federal surveys or instructional materials used in conjunction 
with surveys and to provide consent for their child’s participation in 
them. Second, PPRA requires that state or local education agencies, 
and their contractors or representatives, obtain prior consent from the 
parent if they plan to collect information from students concerning: 

• Political affiliation 

• Mental and psychological problems 

• Sexual behavior and attitudes 

• Illegal or self-incriminating behavior 



PPRA applies to 
programs that receive 
funding from the U.S. 
Department of 
Education. This law 
requires that schools 
and contractors 
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consent from the 
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reveals certain 
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PPRA requires 
education agencies to 
establish procedures 
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The privacy of special 
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protected by FERPA 
and by the 
Individuals with 
Disabilities Education 
Act. 
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maintains, or uses 
personally 
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protect the privacy of 
these special 
education records. 



• Critical assessments of other individuals or family members 

• Privileged information given to lawyers, physicians, or ministers 

• Income (other than what is required by law for program 

eligibility) 

Although PPRA stipulates that education agencies must give par- 
ents the right to review and consent before their children participate 
in surveys, research, or evaluations, the law does not require that par- 
ents be given copies of the surveys or data collection documents. 
However, they must be able to inspect the actual survey and related 
instructional materials within forty-five days of requesting a review. 
Should there be an outstanding request for review, the school or 
agency may not destroy any materials used in connection with a sur- 
vey. Also, agencies must make available copies of such surveys for 
inspection even if a student is not required to participate in them. 

Parents may register complaints, if they believe their privacy 
rights under PPRA have been violated, by submitting their com- 
plaints directly to the appropriate local or state officials. Federal offi- 
cials will review unresolved complaints and document local attempts 
to resolve the complaints. 

The Family Policy Compliance Office (FPCO) of the U.S. 
Department of Education interprets FERPA and PPRA. The office also 
responds to complaints about interpreting or applying the laws. Any 
conflicts between PPRA and state laws or local policies should be for- 
warded for adjudication to the FPCO within forty-five days after the 
conflict was observed. 

D« FERPA and Special Education Records 

The Individuals with Disabilities Education Act (IDEA), Part B, 
provides grants to states to support the education of children with 
disabilities ages three to twenty-one; Part H supports state-sponsored 
early intervention programs for children from birth through age two. 
Confidentiality provisions in IDEA incorporate the provisions in 
FERPA and describe specific applications of the law to records of stu- 
dents with disabilities. The confidentiality regulations under IDEA 
that go beyond FERPA apply only to the records of children with dis- 
abilities who are eligible for special education services under IDEA. 
Parents of children with disabilities must have the opportunity to 
inspect all education records associated with the special services 
their children receive. In particular, they must have access to state or 
local records pertaining to the identification, evaluation, and educa- 
tion placement of their child and services their child receives. 

IDEA confidentiality regulations apply to “participating agen- 
cies,” defined by the law as any agency or institution that collects, 
maintains, or uses personally identifiable information. Records of 
teachers, counselors, and medical or psychological and counseling 
practitioners within participating agencies who work directly with 
children in schools fall within IDEA confidentiality provisions. 
Similarly, IDEA applies to the records of agencies and individuals 
who are contracted to assess students or render services on behalf of 
state or local education agencies. Thus, state or local records about 
the identification, evaluation, and educational placement of their 
children and the provision of free and appropriate education services 
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may be reviewed by parents and eligible students. This includes 
cumulative files with any medical or psychological assessment 
records that are created by specialists outside the school but kept 
within the school files. 

The rules governing the treatment of records of students with dis- 
abilities must be well understood both by educators who work direct- 
ly with families and by administrators who collect, maintain, and 
analyze those records. IDEA requires participating agencies to fully 
inform personnel who collect or use personally identifiable informa- 
tion about their responsibilities for implementing confidentiality pro- 
visions. Participating agencies must protect the confidentiality of 
information at collection, disclosure, and records destruction stages. 
To accomplish this oversight, one official at each participating agency 
must assume responsibility for ensuring the confidentiality of infor- 
mation. 

The definition of parent under IDEA parallels the FERPA defini- 
tion and also includes surrogate parents whom the state designates 
for students without parents. IDEA broadens slightly the definition of 
parent from FERPA, giving access rights to individuals acting in the 
place of a parent or legal guardian, such as a grandmother or steppar- 
ent with whom a child lives, a surrogate parent the state appoints, or 
others who might be legally responsible for a child's welfare. 

As under FERPA, agencies must also afford privacy rights to eligi- 
ble students who are over eighteen or attend postsecondary school, 
even if they are identified for special education services. If necessary, 
records must be interpreted for those who speak a language other 
than English or who have disabilities. The law obligates state and 
local education agencies to comply with requests for access to records 
within forty-five days after requests are received. In addition, parents 
have access to records before individualized education program (IEP) 
meetings or hearings are conducted. 

Several other features of IDEA pertain to the confidentiality of 
records on children with disabilities and exceed FERPA’s require- 
ments: 

• Parents must be informed when records are no longer needed, 
and information must be destroyed at the parents’ request. 

• Without parent consent, agencies or schools may maintain perma- 
nent records of limited identifying information, such as a stu- 
dent’s name, address, and telephone number, his or her grades, 
attendance record, classes attended, grade level completed, and 
year completed. 

• State education agencies must establish policies and procedures, 
including sanctions, to ensure that IDEA requirements are met. 

Exhibits 2-4 and 2-5 summarize the FERPA and IDEA require- 
ments that apply to the education records of students with disabili- 
ties. 



Records pertaining to 
the identification, 
evaluation, and 
educational 
placement of children 
with disabilities and 
the free and 
appropriate public 
education must be 
available for 
inspection by parents. 



Agencies must 
maintain, for public 
inspection, a list of 
employees who have 
access to personally 
identifiable 
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State and local 
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E. Other Federal Laws Affecting Information 
Privacy in Schools 

Student records may be protected simultaneously by laws admin- 
istered by the U.S. Department of Education as well as by other state 
and federal agencies. FERPA establishes a high level of privacy pro- 
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tection, but statutes administered by agencies within the U.S. 
Departments of Agriculture, Health and Human Services, and Justice 
also protect records privacy and may apply to the records of students 
in schools. Professional standards of ethical practice, under which 
school doctors and nurses, psychologists, and other professionals 
operate, may also establish privacy restrictions. Following are some 
examples: 

• Records of drug and alcohol prevention and treatment services for 
students are covered by confidentiality restrictions administered 
by the U.S. Department of Health and Human Services. 

• Some laws establish minors’ rights to seek treatment for certain 
health and mental health conditions, including sexually transmit- 
ted diseases, HIV testing and treatment, pregnancy, and mental 
health counseling. 

• State laws protecting records pertaining to HIV confidentiality, 
medical records, child abuse, privileged communications, and 
state-specific records retention and destruction regulations. 

• Ethical standards of practice and licensure dictate the conduct of 
health and education professionals. 

Confidentiality issues may arise in schools in cases where FERPA 
is not the broadest protection, or where the application of FERPA 
may be unclear. As a result, school personnel must develop an under- 
standing of the principles underlying legal statutes and regulations 
and make every effort to maintain the privacy of any information they 
receive in the course of providing services. School officials increas- 
ingly have access to sensitive health and family information. 

When uncertainty occurs about when and with whom informa- 
tion should be shared, individuals in schools should act with caution 
and understand that their fundamental obligation is to maintain con- 
fidentiality. School personnel should never share with another indi- 
vidual-even a professional-more than is necessary to benefit the stu- 
dent. Legal counsel and school officials are available to interpret mat- 
ters where privacy issues are involved. Teachers, paraprofessionals, 
and principals should not hesitate to consult these individuals when 
they are uncertain about their obligations or their responsibilities. 

The references at the end of this section contain additional guidance 
related to the information presented here. 

Individual student records held by schools or education agencies 
are primarily education records and are therefore subject to FERPA 
regulations, even when other statutes also may apply. If officials per- 
ceive a conflict between FERPA and any state or other federal statutes 
or regulations, they should seek counsel from appropriate legal 
authorities to identify the issues involved and to establish policies 
that accurately reflect applicable legal statutes. 

El. National School Lunch Program 

The National School Lunch Act (NSLA), administered by the U.S. 
Department of Agriculture, provides free or reduced-price meals for 
eligible students. The NSLA governs the National School Lunch 
Program, the School Breakfast Program, and the Special Milk 
Program. It strictly limits how school districts may use individual 
student and household information obtained as part of the eligibility 
process or once students are identified to receive program services. 
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The act ensures that neither eligibility nor program identification 
information may be incorporated into student’s education record. 
Furthermore, the statute establishes criminal penalties for unautho- 
rized disclosures and improper uses of individual school lunch eligi- 
bility or enrollment information. 

Although the use of information collected under the auspices of 
the NSLA about individuals is restricted, in 1994 a modification of 
the law relaxed certain restrictions on how state and local education 
agencies may use information from NSLA records for legally speci- 
fied program evaluations and audits. The amendment allowed limited 
disclosure of information to individuals or agencies that are “directly 
connected with the administration or enforcement” of the NSLA, as 
amended in Public Law 104-149, Section 9 (iii). Specifically, educa- 
tion agencies are now permitted to use data about free and reduced- 
price meal eligibility status for limited federal and state education 
purposes related to the implementation and evaluation of Title I pro- 
grams under the Improving America’s Schools Act. 

In general, state and local education agencies can expect to con- 
tinue restricting information about students receiving NSLA benefits. 
The key determinant for allowing disclosure will be a need-to-know, 
the conditions of which will be defined through future regulations. If 
an agency’s database includes personally identifiable information 
about students, except where allowable by memoranda of agreement, 
database managers must impose controls on the disclosure of that 
information. Before these data can be released, agencies must require 
potential information users to specify the conditions of confidentiali- 
ty under which such information will be disclosed. Information pro- 
vided for one purpose may not be used for another purpose unless 
the reasons for releasing it again have been defined and approved 
according to the law. 

Regulations restricting the use of information collected under the 
auspices of the NSLA were not available at the time these guidelines 
were published. However, a memorandum from the U.S. Department 
of Education dated March 18, 1996 confirmed that education agencies 
may use free and reduced-price meal eligibility data for allocating 
services and for evaluating and reporting of aggregate achievement 
data pertaining to Title I. See Exhibit 2-6 for a copy of the memoran- 
dum. 

E2. Confidentiality of Drug Prevention and 
Treatment Records 

Federal confidentiality laws and regulations prohibit the disclo- 
sure of information about students who apply for or receive alcohol 
or drug abuse treatment services. The Federal Drug and Alcohol 
Patient Records Confidentiality Law (42 CFR) is administered by the 
Substance Abuse and Mental Health Services Administration of the 
U.S. Department of Health and Human Services. The Department of 
Health and Human Services confidentiality regulations apply to 
records of any patient, even a minor student in school, who receives 
treatment from a federally assisted program. Under the law, patients 
include students who receive counseling because they are children of 
alcoholics or drug abusers. 

The confidentiality rules, known as 42 CFR, apply to assessment, 
diagnosis, counseling, group counseling, treatment, or referral for 
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treatment in most programs in which students participate, including 
programs sponsored by public and many private schools. They forbid 
the release of any information without a patient’s consent, even when 
the patient is a student in school and under eighteen years of age. 

The 42 CFR restrictions may conflict with the obligations of 
school-based programs to provide parent access to education records 
of their student. However, the U.S. Department of Education and the 
Substance Abuse and Mental Health Services Administration issued a 
joint opinion in 1990 that suggests potential solutions to this conflict. 
One solution requires students to consent to parent access to records 
as a condition of receiving diagnostic, treatment, or referral services; 
a second solution limits the information kept in school records, rec- 
ognizing that parents may have access to them. Both solutions are 
imperfect, however, and school officials are advised to seek informa- 
tion and advice about potential confidentiality conflicts from their 
state attorney general or from the Family Compliance Office in the 
U.S. Department of Education. Exhibit 2-7 includes examples of 
forms pertaining to releasing confidential information and informing 
patients of their rights under FERPA. 

E3. Forms Clearance Requirements of the Paperwork 
Reduction Acts of 1980 and 1995 

The federal government monitors the paperwork burden of feder- 
al legislation through the Paper Reduction Acts of 1980 and 1995, 
which authorize the Office of the Management and Budget (OMB) in 
the Executive Office of the President to restrict the information that 
agencies may collect from the public. Federal agencies and non-edu- 
cation agencies receiving federal funds must obtain OMB clearance 
authorizing each approved data collection instrument or form. An 
approved information collection form is assigned a clearance number 
and an expiration date to confirm that it is authorized. Approved fed- 
eral data collections must explain the data collection purpose promi- 
nently on the form, whether the data collection is mandated or volun- 
tary, and the benefit(s) to be obtained from the data collection. 

The clearance process also requires that plans for data collection 
stipulate how the data are to be used, along with provisions for 
ensuring confidentiality of any personal data collected. OMB clear- 
ance is not required for the clearance of state or local forms, however. 
OMB clearance ensures that requests for information from student 
records meet the requirements of FERPA. It is unlikely than any 
records requiring release of personally identifiable information would 
be requested in OMB-approved data collections. 

E4. Using Social Security Numbers as Student 
Identification Codes 

Section 7(a) of the Privacy Act of 1974 addresses the use of social 
security numbers by federal, state, or local governments. It states that 
it is 

...unlawful for any federal, state, or local government agency to 
deny to any individual any right, benefit or privilege provided by 
law because of such individual’s refusal to disclose his social 
security account number 
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When government agencies collect social security numbers for 
reasons other than those allowed in the original law, they must speci- 
fy how the numbers will be used and the limits of their use. Requests 
for social security numbers must be accompanied by the following 
notice: 

Any federal, state, or local government agency which requests an 
individual to disclose his social security account number shall 
inform that individual whether that disclosure is mandatory or 
voluntary, by what statutory or other authority such number is 
solicited, and what uses will be made of it. 

State and local education agencies can minimize challenges to 
their use of social security numbers for student records identification 
by creating alternative identification numbers for students whose par- 
ents object to using social security numbers for identification. 

F. Resources For Interpreting Federal Laws TEhatf 
Protect the Privacy of Education Records 

A number of private and public agencies monitor federal activity 
on privacy and confidentiality issues. In the federal government, the 
Office of Information and Regulatory Affairs (OIRA) in OMB of the 
Executive Office of the President, oversees the implementation of 
major privacy laws. For each law, specific agency offices respond to 
questions and complaints from citizens. As new issues arise and the 
U.S. Congress passes new laws, these agencies develop regulations 
that define the regulations for applying the laws. 

Two federal offices can respond to questions. First, the U.S. 
Department of Education can assist in interpreting FERPA and PPRA 
and respond to complaints about the interpretation or application of 
these laws through: 

• Family Policy Compliance Office 
U.S. Department of Education 
600 Independence Avenue, SW 
Washington, DC 20202 

(202) 260-3887 

Second, the Information Resources Group can provide additional 
information about broad issues administered by OMB: 

• Information Resources Group 

Office of Information and Regulatory Affairs 
725 17th Street, NW 
Washington, DC 20503 
(202) 395-7316 

The Council of Chief State School Officers (CCSSO), working 
with representatives of state education agencies, is also monitoring 
the evolution of privacy laws. As the need arises, CCSSO will devel- 
op public information to clarify the legal responsibilities and obliga- 
tions of state and local school officials and concerned parents. 
Additional information can be obtained by contacting: 

• Council of Chief State School Officers 
One Massachusetts Avenue, NW 
Suite 700 

Washington, DC 20001 
(202) 408-5505 
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Other national groups have organized to monitor and interpret 
privacy implications of federal laws about the education, health, and 
social services for children. Among them are the following organiza- 
tions that provide information and respond to questions: 

• Center for Law and Social Policy 
1616 P Street, NW, Suite 150 
Washington, DC 20036 

(202) 328-5140 

• Education Commission of the States 
707 Seventeenth Street, Suite 2700 
Denver, CO 80202-3427 

(303) 299-3600 

• National Association of State 
Directors for Special Education 
1800 Diagonal Road, Suite 320 
Alexandria, VA 22314 

(703) 519-3800 

• Youth Law Center 

111 Sansome Street, Suite 950 
San Francisco, CA 94104 
(415) 543-3379 
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EXHIBIT 2-1 
FACT SHEET: 

Family Educational Rights and Privacy Act of 1974 1 



The Family Educational and Privacy Act (FERPA) is a 
Federal law designed to protect the privacy of a stu- 
dents education records. The law applies to all 
schools which receive funds under an applicable pro- 
gram of the U.S. Department of Education. 

FERPA gives parents certain rights with respect to their 
childrens education records. These rights transfer to 
the student, or former student, who has reached the 
age of eighteen or is attending any school beyond 
the high school level. Students and former students to 
whom the rights have transferred are called eligible 
students. 

Parents or eligible students have the right to 
inspect and review all of the students education 
records maintained by the school. Schools are 
not required to provide copies of materials in 
education records unless, for reasons such as 
great distance, it is impossible for parents and 
eligible students to inspect the records. Schools 
may charge a fee for copies. 

Parents and eligible students have the right to 
request that a school correct records believed to 
be inaccurate or misleading. If the school 
decides not to amend the record, the parent or 
eligible student then has the right to a formal 
hearing. After the hearing, if the school still 
decides not to amend the record, the parent or 
eligible student has the right to place a statement 
with the record commenting on the contested 
information in the record. 

✓ Generally, the school must have written permis- 
sion from the parent or eligible student before 
releasing any information from a students record. 
However, the law allows schools to disclose 
records, without consent, to the following parties: 

• School employees who have a need-to-know 

• Other schools to which a student is transfer- 
ring; 



• Certain government officials in order to carry 
out lawful functions; 

• Appropriate parties in connection with finan- 
cial aid to a student; 

• Organizations doing certain studies for the 
school; 

• Accrediting organizations; 

• Individuals who have obtained court orders 
or subpoenas; 

• Persons who need to know in cases of health 
and safety emergencies; and 

• State and local authorities, within a juvenile 
justice system, pursuant to specific state laws. 

Schools may also disclose, without consent, "directo- 
ry" type information such as a students name, 
address, telephone number, date and place of birth, 
honors and awards, and dates of attendances. 
However, schools must tell parents and eligible stu- 
dents about directory information and allow parents 
or eligible students a reasonable amount of time to 
request the school not disclose directory information 
about them. 

Schools must notify parents and eligible students of 
their rights under this law. The actual means of notifi- 
cation (special letter, inclusion in a PTA bulletin, stu- 
dent handbook, or newspaper article) is left to the 
discretion of each school. 

For additional information or technical assistance, you 
may call (202) 260-3887 or TDD (202) 260-8956 
or contact: 

Family Policy Compliance Office 
U.S. Department of Education 
600 Independence Avenue, SW 
Washington, D.C. 20202-4605 



Developed by the Fomily Policy Compliance Office of the 
U.S. Deportment of Educotion. 
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EXHIBIT 2-2 
FACT SHEET: 

Protection of Pupil Rights Amendment 1 



The protection of Pupil Rights Amendment (PPRA), 20 
U.S.C. 1232h, applies to programs that receive 
funding from the U.S. Department of Education. The 
law was amended under the "Goals 2000: Educate 
America Act" on March 31, 1994. The Department 
issued a Notice of Proposed Rulemaking on August 
28, 1995, to reflect changes in the law. Final regula- 
tions are expected in early 1997. 

PPRA is intended to protect the rights of parents and 
students in two ways: 

• It seeks to ensure that schools and contractors 
make instructional materials available for inspec- 
tion by parents if those materials will be used in 
connection with a Department of Education-fund- 
ed survey, analysis, or evaluation in which their 
children participate; and 

• It seeks to ensure that schools and contractors 
obtain written parental consent before minor stu- 
dents are required to participate in any 
Department of Education-funded survey, analysis, 
or evaluation that reveals information concerning: 

1 . Political affiliation; 

2. Mental and psychological problems poten- 
tially embarrassing to the student and his/her 
family; 

3. Sex behavior and attitudes; 



4. Illegal, anti-social, self-incriminating and 
demeaning behavior; 

5. Critical appraisals of other individuals with 
whom respondents have close family relation- 
ships; 

6. Legally recognized privileged or analogous 
relationships, such as those of lawyers, physi- 
cians, and ministers; or 

7. Income (other than that required by law to 
determine eligibility for participation in a pro- 
gram or for receiving financial assistance 
under such program). 

Parents or students who believe their rights under 
PPRA may have been violated may file a complaint 
with the Department of Education by writing the 
Family Policy Compliance Office. Complaints must 
contain specific allegations of fact giving reasonable 
cause to believe that a violation of PPRA occurred. 

For additional information or technical assistance, you 
may call (202) 260-3887 or TDD (202) 260-8956 
or contact: 

Family Policy Compliance Office 

U.S. Department of Education 

600 Independence Avenue, SW 
Washington, D.C. 20202-4605 
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Developed by the Family Policy Compliance Office of the 
U.S. Department of Education. 
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EXHIBIT 2-3 

Model Notification of Rights under FERPA 
for Elementary and Secondary Institutions 1 



The Family Educational Rights and Privacy Act (FERPA) 
affords parents and students over 1 8 years of age 
("eligible students") certain rights with respect to the 
student's education records. They are: 

( 1 ) The right to inspect and review the students edu- 
cation records within 45 days of the day the 
District receives a request for access. 

Parents or eligible students should submit to the 
school principal [or appropriate school official] a 
written request that identifies the record(s) they 
wish to inspect. The principal will make arrange- 
ments for access and notify the parent or eligible 
student of the time and place where the records 
may be inspected. 

(2) The right to request the amendment of the student's 

education records that the parent or eligible stu- 
dent believes are inaccurate or misleading. 

Parents or eligible students may ask Alpha School 
District to amend a record that they believe is 
inaccurate or misleading. They should write the 
school principal, clearly identify the part of the 
record they want changed, and specify why it is 
inaccurate or misleading. 

If the District decides not to amend the record as 
requested by the parent or eligible student, the 
District will notify the parent or eligible student of 
the decision and advise them of their right to a 
hearing regarding the request for amendment. 
Additional information regarding the hearing pro- 
cedures will be provided to the parent or eligible 
student when notified of the right to a hearing. 

(3) The right to consent to disclosures of personally 
identifiable information contained in the students 
education records, except to the extent that 
FERPA authorizes disclosure without consent. 



One exception which permits disclosure without 
consent is disclosure to school officials with legiti- 
mate educational interests. A school official is a 
person employed by the District as an administra- 
tor, supervisor, instructor, or support staff member 
(including health or medical staff and law 
enforcement unit personnel); a person serving on 
the School Board; a person or company with 
whom the District has contracted to perform a 
special task (such as an attorney, auditor, med- 
ical consultant, or therapist); or a parent or stu- 
dent serving on an official committee, such as a 
disciplinary or grievance committee, or assisting 
another school official in performing his or her 
tasks. 

A school official has a legitimate educational 
interest if the official needs to review an educa- 
tion record in order to fulfill his or her profession- 
al responsibility. 

[Optional] Upon request, the District discloses 
education records without consent to officials of 
another school district in which a student seeks or 
intends to enroll. [NOTE: FERPA requires a school 
district to make a reasonable attempt to notify the 
student of the records request unless it states in its 
annual notification that it intends to forward 
records on request.] 

(4) The right to file a complaint with the U.S. 

Department of Education concerning alleged fail- 
ures by the District to comply with the require- 
ments of FERPA. The name and address of the 
Office that administers FERPA is: 

Family Policy Compliance Office 
U.S. Department of Education 
600 Independence Avenue, SW 
Washington, DC 20202-4605 

[NOTE: In addition, a school may want to include its 

directory information public notice, as required by 

§99.37 of the regulations, with its annual notification 

of rights under FERPA.] 



Developed by the Fomily Policy Complionce Office of the 
U.S. Deportment of Educotion. 
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EXHIBIT 2-4 

Requirements under FERPA 
Applicable to General Education and 
Special Education Records 1 



1 . Publicly list the items of personally identifiable 
information the school designates as directory 
information. 

2. Establish the procedures the education agency or 
school will follow when a parent or eligible stu- 
dent requests the opportunity to inspect the stu- 
dent's education records. 

3. Publicly list the types and location of education 
records the school maintains, giving the titles and 
addresses of the records custodian. 

4. Establish that the school will not disclose informa- 
tion in a students record without the prior written 
consent of the parent or eligible student, except 
as permitted by law. 

5 . Set the criteria the education agency will use to 
determine which school officials have a "legiti- 
mate educational interest" in accessing informa- 
tion from a students record. 



6. Define procedures for notifying parents and eligi- 
ble students of their rights under FERPA; notices 
must be made annually and in a language that 
can be understood. 

7. Define procedures for a parent or eligible student 
to file a complaint concerning an alleged failure 
of the school, district, or state agency to comply 
with FERPA. 

8. Publish a schedule of fees the agency intends to 
charge for copies of education records. 

9. Annually notify parents or eligible students of their 
rights to seek correction of records, including the 
right to place a written rebuttal in the record. The 
notification must be available in a language the 
parent or eligible student understands. 



43 

Adapted from Resource Handbook For School Administrators: 

Confidentiality Requirements of General Education And 
Handicapped Student Education Records. Oakland 
(Michigan) Schools Department of Pupil Services, Waterford, 

Michigan, 1992. 
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EXHIBIT 2-5 

Privacy Requirements Applicable 
Only to the Education Records 
of Students with Disabilities 1 



In addition to FERPA requirements that apply to all stu- 
dent education records, education agencies must 
establish the following procedures for ensuring the pri- 
vacy of the records of students who receive services 
under the IDEA: 

1 . Permit a representative of parents to inspect the 
student's education record. 

2. Designate an official at each participating 
agency who is personally responsible for safe- 
guarding the confidentiality of identifiable infor- 
mation about students with disabilities during col- 
lection, storage, disclosure, an destruction stages. 



3. Obtain parent permission prior to any disclosure 
of records, unless it is authorized by FERPA with- 
out such permission. 

4. Inform parents when information is no longer 
needed to provide education services and 
destroy records at the request of parents. 

5. The state education agency must describe in a 
state plan the policies and procedures, including 
sanctions, used to ensure it meets IDEA require- 
ments and regulations. 



Adapted from Resource Handbook For School Administrators : 
Confidentiality Requirements of General Education And 
Handicapped Student Education Records. Oakland 
(Michigan) Schools Department of Pupil Services, Waterford, 
Michigan, 1992. 
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EXHIBIT 2-6 

Memorandum Regarding the Use 
of Free and Reduced-Price Lunch Data 
for Title I Purposes 



MEMORANDUM TO CHIEF STATE SCHOOL OFFICERS 

SUBJECT: Use of Free and Reduced Price Lunch Data for Title I 



As many of you are aware, we have been working with officials at 
the U.S. Department of Agriculture (USDA) regarding the use of 
free and reduced price lunch data for Title I purposes. 

Section 108 of Public Law 103-448, the Health Meals for Healthy 
Americans Act of 1994, authorizes the release of student free and 
reduced school mean eligibility status for Federal and Sate 
education programs. Because of the sensitivity of this 
information and the intent to publish regulations implementing 
this section, USDA issued a memorandum several months ago state 
that the use of such information for Federal and State education 
programs would not be permissible until such regulations were 
published. However, since that memorandum was issued, our 
Department has worked closely with USDA to explain the need for 
such information for the Title I program. As a result of our 
discussions, USDA issued the enclosed memorandum that authorizes 
the release of free and reduced school eligibility information 
for Title I purposes. 

Please feel free to contact me should you have any further 
questions on this matter. 




UNITED STATES DEPARTMENT OF EDUCATION 

WASHINGTON, D.C. 20202 - £132 

March 18, 1996 



Purposes 




“Mary Jean LeTendre 
Director 

Compensatory Education Programs 



Enclosure 



cc: State Title I Coordinators 
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SUBJECT: Cooperation with Education Officials — Title I 

To: Regional Directors 

Special Nutrition Programs 
All Regions 

Section 108 of Public Law 103-448 authorizes the release of 
student free and reduced price school meal eligibility status for 
Federal and State education programs. Although we intend to 
promulgate regulations on the provision, we have not been able to 
publish the provision on a timely basis. Consequently, we are 
authorizing school officials, through this memorandum to 
cooperate with education officials collecting data for Title I 
purposes. 

Under current policy, school food service officials may release 
aggregate information about the number of children eligible for 
free and reduced price meals. Additionally, we are now 
authorizing school food service officials to disclose the names 
of individual children who are eligible for free or reduced price 
meals, to officials collecting data for Title I allocation and 
evaluation purposes. While we are authorizing the release of 
this information, the final decision rests with local officials. 

For allocation of funds under Title I, public schools are usually 
annually ranked according to the number of children eligible for 
free and reduced private school meals as an annual indicator of 
the socioeconomic status of the school’s attendance area. While 
Title I funds are not dispersed to private schools, children from 
the attendance area who attend private schools may still be 
included in the total count of needy children living in the 
attendance area. Therefore, private schools that participate in 
the school nutrition programs may release the addresses, grade 
levels and eligibility status of children determined eligible for 
free and reduced price school meals to Title I officials. It 
should be noted that private schools would not need to release 
the names of free and reduced price eligible students, since 
addresses are sufficient to determine attendance areas. 
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While in some instances aggregate release of free and reduced 
price school meal information is sufficient, food service . 
officials may be asked to provide the names and eligibility 
status of individual children for Title I evaluation purposes. 
Consequently, school food service officials may cooperate with 
education officials for evaluation of Title I services. The 
Department of Education has been advised of this policy in the 
attached letter to Mary Jean LeTendre, Director of Compensatory 
Education Programs for that Department. 

Please provide your States with copies of this memorandum and 
attached letter. You may contact Charles Heise or Barbara Semper 
at (703) 305-2968 with any questions. 

SIGNED 

Alberta C. Frost 

Director 

Child Nutrition Division 



Attachment 
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EXHIBIT 2-7 

Examples of Forms Pertaining to 
Releasing Confidential Information 
That Informs Patients of Their Rights 
under 42 CFR 



CONFIDENTIALITY OF 

ALCOHOL AND DRUG ABUSE PATIENT RECORDS 

The confidentiality of alcohol and drug abuse patient records maintained 
by this program is protected by Federal law and regulations. Generally, 
the program may not say to a person outside the program that a patient 
attends the program, or disclose any information identifying a patient as 
an alcohol or drug abuser unless : 

(1) The patient consents in writing; OR 

(2) The disclosure is allowed by a court order; OR 

(3) The disclosure is made to medical personnel in a medical 
emergency or to a qualified personnel for research, audit, or 
program evaluation; OR 

(4) The patient commits or threatens to commit a crime either at the 
program or against any person who works for the program. 

Violation of the Federal law and regulations by a program is a crime. 
Suspected violations may be reported to the United States Attorney in the 
district where the violation occurs. 

Federal law and regulations do not protect any information about suspect 
child abuse or neglect from from being reported under state law to 
appropriate state or local authorities. 

(See 42 U.S.C. § 290dd-2 for Federal law and 42 CFR Part 2 for 
Federal regulations.) 



Legal Action Center. (1996) Handbook on legal issues for school-based programs (Revised), pp. 71 , 72, & 
74. New York: Author. 
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PROHIBITION ON REDISCLOSURE 
OF INFORMATION CONCERNING CLIENT 
IN ALCOHOL OR DRUG ABUSE TREATMENT 



This notice accompanies a disclosure of information concerning a 
client in alcohol/drug abuse treatment, made to you with the 
consent of such client. This information has been disclosed to you 
from records protected by Federal confidentiality rules (42 CFR Part 
2). The Federal rules prohibit you from making any further 
disclosure of this information unless further disclosure is expressly 
permitted by the written consent of the person to whom it pertains 
or as otherwise permitted by 42 CFR Part 2. A general 
authorization for the release of medical or other information is NOT 
sufficient for this purpose. The Federal rules restrict any use of the 
information to criminally investigate or prosecute any alcohol or 
drug abuse patient. 



CONSENT FOR RELEASE 
OF CONFIDENTIAL INFORMATION 





(Name of patient) 



authorize 



(Name of general designation of program making disclosure) 



to disclose to 



(Name of person or organization to which 
disclosure is to be made) 



following information: 



(Nature of the information, as limited as possible) 



The purpose of the disclosure authorized herein is to: 



(Purpose of disclosure, as specific as possible) 



I understand that my records are protected under federal regulations govern- 
ing Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2, and 
cannot be disclosed without my written consent unless otherwise provided for in the 
regulations. I also understand that I may revoke this consent at any time except to the 
extent that action has been taken in reliance on it, and that in any event this consent 
expires automatically as follows: 



(Specification of the date, event, or condition upon which this consent expires) 

Dated: 

Signature of participant 



Signature of parent, guardian 
or authorized representative 
when required 
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SECTION 3 : 

Protecting the Privacy of Individuals 
during the Data Collection Process 



Suggested audiences: 



g/ State education agency staff 
0/ School district staff 
t / Program and support services staff 
0/ Technical staff 

OVERVIEW 



When you are asked to answer questions about your child or your 
family, do you wonder how the person asking the questions will use 
the information and what would happen if you gave the wrong 
answers? Everyone is concerned about releasing personal information 
to a stranger, and everyone wonders just how many people will see 
the responses. 



School systems must have information about their students if they 
are to make appropriate decisions about educational and support pro- 
grams. From the time a child enters school, records begin to follow the 
new student. Besides the information provided by the student or par- 
ent, such as basic enrollment and immunization status, school staff 
create a paper trail to describe the student’s educational program, 
extracurricular activities, and other relevant experiences. Deciding 
what data to gather along the paper trail requires careful consideration 
of what information is needed by the school system and how best to 
collect it. In addition, however, the school system should take into 
consideration the concerns of students and their families. The princi- 
ples in this section should be considered no matter who collects the 
data or how and why the data are collected about students. 



COMMONLY ASKED QUESTIONS 



Q. How do I decide what information to collect about a student? 

A. You can check state and local laws and regulations as well as 
school board policies for the types of information you are required 
to collect Other than these requirements , agency or school staff 
should carefully consider the needs for the information against the 
costs and burden of collecting it. See Section 3, Guidelines A and B, 



Q. Must I have permission from the parents to give an achievement 
test to a student? 



A. Permission from parents is not usually needed for achievement 
testing unless state or local policies related to obtaining parental 
permission already exist In general, you should inform parents of 
the purposes and uses of testing and whether it is mandatory. See 
Section 3, Guidelines B; also see discussion of the Protection of 
Pupil Rights Amendment (PPRA) in Section 2, Guidelines C. 
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Q. How responsible am I for the accuracy of the student data I 
receive? 

A. In general , data collectors are more ethically than legally 
responsible. You can promote the accuracy and integrity of the data 
in several ways. See Section 3 , Guidelines D. 

Q. When can I destroy student records? When not? 

A. Agencies or schools may establish their own policies , based on 
federal and state legal requirements , to determine the length of 
time records or portions of records are kept. See Section 3, 
Guidelines E. However , you may not destroy a record if there is a 
pending request to review it. See Section 5. 

Q. Can I use social security numbers to identify or match education 
records? 

A. Yes, you may use social security numbers if your state has no 
prohibition against using them. However, you may not require 
students to provide them. It is important for you to inform students 
or parents if agencies or schools intend to use these numbers. See 
Section 3, Guidelines F. 

GUIDELINES 



A. Determining the Agency's Student Data Needs 
and Uses 



Data collectors must 
justify the need for 
every item of 
information included 
in an individual 
education record. 



Usually, data are collected because they are: 

• Required by laws or regulations 

• Used to promote the efficiency and effectiveness of the agency 

• Used to aid in the placement of students 

• Needed for accountability and funding decisions 

• Used to determine student progress and student needs 

Schools or agencies can use data for administrative purposes in 
five major ways: 

• Operations 

• Instruction 

• Management 

• Research and evaluation 

• Accountability 

When schools, school districts, and state education agencies 
decide to collect and maintain personally identifiable data about stu- 
dents, the intended uses of the data must be identified. Some data 
about students are collected because they are required by law or regu- 
lation to protect civil rights or assess accountability. The law or regu- 
lation in these cases provides the justification for the collection of the 
information. Other types of data are collected to promote the efficien- 
cy and effectiveness of the agency and are justified under school 
board or state board of education policy. Still other data about indi- 
vidual students are collected to determine their progress, place them 
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into appropriate learning experiences, and otherwise assist the school 
in meeting the needs of the students. 

When data about students are aggregated, information may be 
used for program accountability and funding decisions. Each piece of 
information included in an education record should represent a clear 
and important need for obtaining and recording that information. 
Schools, school districts, and state education agencies may need stu- 
dent data for the following major administrative purposes: 

• Operations — Schools and districts need data to ensure the effi- 
ciency of their day-to-day functioning. For example, schools must 
maintain attendance records, handle students’ health problems, 
and operate transportation and food service programs. Personally 
identifiable data are needed for such operations. 

• Instruction — Teachers and other staff members also need student- 
level information to ensure that students receive appropriate 
instruction and services. For example, teachers need to know 
how to contact parents, and they need information about a stu- 
dent’s previous educational experiences and special needs to help 
plan instruction. Counselors need to know what courses students 
have taken in order to plan their educational programs. 

Personally identifiable data, thus, are needed for instructional 
decisions. 

• Management — Schools, districts, and state education agencies 
use data about students to assist in the planning and scheduling 
of educational programs and the distribution of resources (e.g., 
fiscal, staffing, and materials). Management functions generally 
do not require personally identifiable information. However, data 
should be maintained at a specific-enough level that required dis- 
tinctions (e.g., how many children qualify for certain programs) 
can be made. 

• Research and Evaluation — Schools, school districts, and state 
education agencies conduct analyses of program effectiveness, the 
success of subgroups of students, and changes in achievement 
over time to identify effective instructional strategies and to pro- 
mote school improvement activities. These data may or may not 
be personally identifiable. 

• Accountability — Answering the questions of parents, policymak- 
ers, and other participants in the education enterprise about stu- 
dents’ accomplishments and the effectiveness of schools has 
become an important function of data collected by schools. 
Reporting functions generally do not require personally identifi- 
able data. However, some personally identifiable data are needed 
in order to carry out longitudinal analyses that may be crucial in 
assessing a program’s effectiveness. 

Efficient maintenance of data about individual students allows 
data needed for one purpose to be used for other appropriate purpos- 
es. However, the uses must be justified under existing policies, and 
data providers should be informed of these uses. For example, infor- 
mation about a student’s home language collected for required aggre- 
gate federal reporting could also be used in the evaluation of a 
school’s language programs. In these instances, personally identifi- 
able information that is used for the analyses cannot be publicly 
released without written approval from the parents. 



Maintaining data 
efficiently allows data 
to be used for 
multiple purposes. 
However, you must 
justify all uses under 
existing policies and 
inform data providers 
of these uses. 
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You should consult 
state and local laws, 
policies of school 
boards, and 
professional ethics in 
deciding what 
information to collect 
and maintain about 
students. 



Data providers should 
be informed about 
why the information 
is collected and if 
providing such 
information is 
mandatory. 



Data collectors should 
demonstrate that the 
data produced will be 
of sufficient value, 
applicability, and 
usefulness to justify 
the cost and burden 
of collecting them. 



Written policies help 
to classify the data 
into directory 
information, 
transcript 
information, or 
supplemental 
information, and to 
determine how you 
should maintain and 
release each piece of 
information. 



B. What Information Can Be Requested 
about Students? 

In general, schools and education agencies are not restricted in 
what they may request about students; this is determined by state 
laws and regulations, the policies of the school, district or state edu- 
cation agency, and the professional ethics of staff. However, federal 
law (i.e., PPRA) does specify several types of questions that cannot be 
asked without prior consent of the parents. See Section 2, Guidelines 
C for a detailed discussion. A good practice is to collect and maintain 
in the education records only those data for which a clear and specif- 
ic purpose has been identified. 

In deciding what data can be requested from individuals, you 
must consider several important and practical factors. Data collection 
can be a burden on the data providers if too many questions are asked 
or the completion of the form is too time consuming. If the way in 
which questions are asked makes it unclear what information is 
requested, the accuracy of the data may be undermined. An important 
rule of thumb in data collection is that the data need should outweigh 
data burden and collection problems. Justification for data collection 
should state what methods will be used to guard against non-response, 
inaccuracy, and privacy intrusion. A good resource to use in deciding 
what information to collect is the Standards for Education Data 
Collection and Reporting, published by the U.S. Department of 
Education’s National Center for Education Statistics in 1991. 

C. Classifying Data Elements or Record Sensitivity 

It is good practice for you to have a written policy describing 
what parts of education records are sensitive and exactly which data 
elements may be released as directory information and which ones 
may be released to different types of staff members. The California 
Department of Education has produced several sets of internal poli- 
cies and guidelines regarding classifying data sensitivity and access. 
Exhibit 3-1 summarizes these policies and guidelines. You could 
cover some of the following areas in creating your written policy. 

Each data element to be maintained about an individual student 
should be classified as to whether it is a part of the directory informa- 
tion (subject to public release), a part of the transcript information 
(will be released in a student’s transcript if he or she transfers to 
another district or applies to a postsecondary education institution), 
or is supplemental (all the other information collected, e.g., bus route 
and class schedule). This can be noted for each data element in a data 
dictionary for an automated student information system. For paper 
records, there may be a notation accompanying the item on the col- 
lection form. 

Within the agency, certain staff members may be allowed access 
to information on individual students based on a legitimate educa- 
tional interest, or the staff’s need-to-know. It is a good idea to classify 
each data element according to the type of staff member who may 
have access. Most persons with a need-to-know must have the infor- 
mation to make instructional or other support decisions. Some other 
persons will be involved in the collection or the maintenance of data, 
and will therefore have access to the information contained within 
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Section 3: protecting the privacy of Individualizing the data Collection process 



the record (e.g., the school secretary). In Section 4, we discuss the 
federal requirement to establish guidelines for determining who has a 
legitimate educational interest. You can design maintenance proce- 
dures, which we also discuss in Section 4, to limit access according 
to this policy. 

The written policy may include a description of how parents and 
students (over age eighteen) are to be informed about what types of 
data are kept in the education records. The policy may also specify 
whether data are considered a part of directory information, the educa- 
tion record or transcript information, or the supplemental record for 
use only within the school or agency. The written policy may also note 
that certain types of data are not considered a part of the education 
record and are not subject to inspection by the student or parents (e.g., 
personal notes maintained by a teacher or a substitute in a location 
separate from the official education records, or personal notes written 
by a school counselor that are not shared with anyone else). Exhibit 3-2 
contains an example of a school district’s notification policy. This 
brochure not only notifies parents of their rights, but also disseminates 
information about how the school district maintains records. 



Ensuring Dssfra Integrity and Accuracy 

Data collectors may promote data integrity and accuracy through 
two efforts: 

• Making sure data providers understand the importance of the data 

• Designing the data collection activity and training survey staff to 

respect the dignity of the respondents 

An important consideration in choosing data elements and the 
procedures to collect data is the quality of the data that will be 
received. Data integrity means that the information provided is com- 
plete and unchanging; data accuracy means that the information is 
correct. 

Two issues are important in ensuring data integrity and accuracy. 
The first is the degree to which the data provider (usually the student 
or parent) supports the data collection. It is important for students 
and their parents to know if the data being requested are required by 
law or for the purposes of ensuring that certain services can be 
received by the child. They need to understand when failure to pro- 
vide accurate and complete data may result in the denial of benefits 
(e.g., immunization records required to enroll a child in school). For 
most data elements or data collection forms, you should inform stu- 
dents or their parents about why the data are important and how they 
will and will not be used. Written assurances of data confidentiality 
often alleviate concerns and elicit more cooperation, but not in all 
cases. You should be prepared to respond openly and thoroughly to 
hard questions raised by parents and privacy advocates. 

A second issue that can affect data integrity and accuracy is the 
design of the data collection activity and the training provided to 
data collectors. Training is important for all staff who might be 
involved in collecting student information, regardless of the purpos- 
es. Such staff may include teachers, school secretaries, school nurses, 
guidance counselors, principals, and evaluators. Areas that should be 
included in staff training are: 



When you choose 
data elements and the 
procedures to collect 
them, you should 
consider the quality 
of the data. 
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• The distinction between collecting data that are mandatory and 
those that are voluntary; and the options of the student or parent 
regarding provision of the data (e.g., what services might be 
missed, such as free meals) 

• The ethical and legal responsibilities of staff to prevent unautho- 
rized use or disclosure of data 

• The ways staff can obtain explanations or other help while col- 
lecting the data 

The training should focus on how the questions or requests for 
information may be stated by the staff person to ensure that the 
request is clear and the data can be collected consistently from all 
individuals. For instance, it is important for data collection proce- 
dures to ensure that parents and students have the opportunity to 
provide accurate answers regardless of their language, cultural, or 
educational backgrounds. Staff should be sensitive to and respectful 
of respondents’ privacy and their possible reluctance to answer a 
question. The information belongs to the individual; you are just 
“borrowing” it. 



You can derive 
unique identification 
codes by a variety of 
methods (e.g., 
assigning sequential 
numbers or adopting 
algorithms to generate 
codes using selected 
characteristics). 



E. Assigning and Using Unique Identification Codes 

Using unique identification codes would: 

• Allow the records to follow the correct students when they move 
within the state 

• Provide the flexibility of merging data from different files to pro- 
mote efficiency without threatening privacy 

In schools that keep all the data about an individual student in an 
education record on paper in a file folder, a unique identification 
code may not be necessary. Many large schools and school districts 
maintain data about their students in computerized or automated 
records. Having unique identification codes provides the flexibility to 
merge data from different computer files for use in making effective 
program decisions about children. If a student moves frequently, the 
unique identification code may help to ensure that information will 
follow the correct student. School districts and state education agen- 
cies increasingly use unique identification codes to help locate stu- 
dents who have moved within the education system. 

Many schools and school districts assign a unique sequential 
identification number or code to each student when he or she enrolls 
in school. Unique identification codes help to distinguish between 
students with similar or identical names and other characteristics. 

However, the uses of the code are often determined by its source. 
Some state education agencies assign a set of sequential identification 
numbers for schools or school districts to use so that the identifica- 
tion number of a student is unique within the state. Other schools, 
school districts, and state education agencies adopt an algorithm for 
assigning unique identification codes. These algorithms generally 
include some combination of letters and numbers taken from the stu- 
dent’s last name, first name, date of birth, and place of birth. The 
code may also incorporate a number for the agency or school. Such 
an identification code may be sufficient if students stays within the 
school or agency for their entire school career. If the student moves, 
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however, the receiving school may assign a new identification code 
rather than track down the student’s previous code. 

Social security numbers are used in many cases as an identifier. 
The social security number has the advantage of being unique to stu- 
dents and does not change when they move to another city or state. 
While federal law restricts the use and release of social security num- 
bers, it does not prohibit schools from asking for the number. 
Specifically, schools can ask for a child’s social security number but 
cannot require it, and schools must inform parents that they do not 
have to provide the social security number. Schools also cannot deny 
any right, privilege, or benefit to students or their parents who refuse 
to disclose a social security number. Schools that use social security 
numbers should be prepared to issue an alternative code in case of 
such refusal. 

Schools, school districts, and state education agencies cannot 
release the social security numbers of students because this is consid- 
ered personal information. A more thorough discussion of the use of 
social security numbers is included in Education Data 
Confidentiality: Two Studies , a report of the National Forum on 
Education Statistics, National Center for Education Statistics of the 
U.S. Department of Education in 1994. 

You should consider several things about using social security 
numbers. The social security number is unique to individuals no mat- 
ter where they live. It is useful across schools, districts, and states. 
Using the social security number thus can make it easier for schools 
to locate the appropriate transcript or student information when they 
receive a request. On the other hand, parents may not recall the social 
security number for their children, or may give a wrong number, such 
as their own. It is difficult and time consuming to check the accuracy 
of a social security number. 

Since social security numbers are used to maintain confidential 
information by other agencies outside the education system, it is cru- 
cial to ensure that no one gets illegal access to the numbers. Security 
is far more important with social security numbers than locally 
assigned identifiers. Even if the social security number is used to 
maintain education records internally, agencies may want to assign 
another number for the identification card of a student or for school 
use, and restrict the use of the social security number to very limited 
purposes. 

F. How Long Should Data Be Maintained? 

Many states have legal requirements defining how long education 
records must or may be kept. There may also be federal requirements 
for how long some data should be maintained. School districts 
should have more specific policies noting exactly which data to store 
and how long data should be maintained. For instance, transcript 
information for high school completers is often kept active for a fixed 
length of time, such as five to ten years. In the past, such deadlines 
were helpful because there was limited space to save paper files. 

With computer files, space is no longer as significant a problem, and 
student transcripts may be kept active even longer. Two recommend- 
ed components to include in a school or district data policy are a list- 
ing of what data elements are included in the high school transcript 



Many agencies and 
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security numbers as 
the identification 
codes. Schools may 
ask for social security 
numbers but cannot 
require them. 



Using social security 
numbers may be 
helpful to agencies or 
schools in 
maintaining 
appropriate and 
accurate information 
about the students. 
However, school 
officials must protect 
the numbers from 
illegal access and 
unauthorized release. 



In addition to federal 
and state 
requirements, 
agencies or schools 
should establish 
policies to determine 
the length of time 
each type of data is 
maintained and how 
data will be expunged 
or replaced. 
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or education record (sent with students when they move) and a time 
period for how long these records will be maintained. 

Other types of data (e.g., after-school care arrangements or 
extracurricular activities) may not be needed after a certain period of 
time (e.g., one year or after a student has left the school.) It is a good 
idea to include in a written data policy an indication of which data 
elements will be expunged from education records and when they 
will be deleted. 

Finally, there are some data that a school or agency may want to 
expunge to protect the student. Disciplinary actions are an example; 
state law or local policy usually governs these cases. 
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SECTION 3: PROTECTING THE PRIVACY OF INDIVIDUALS DURING THE DATA COLLECTION PROCESS 



EXHIBIT 3-1 

An Example of Classifying and Categorizing 
Education Record Contents 
by a State Education Agency 1 



Table 1. Pupil Records Contents 




Mandatory Permanent 


Mandatory Interim 


Permitted 


(minimum) 




(for educational purposes) 


A. Legal name 


A. Access log 


A. Objective staff ratings 


B. Date of birth 


B. Health records 


B. Standardized tests 
more than 3 years old 


C. Birth date verification 


C. Special Ed Programs 

1 . Tests 

2. Forms 

3. Case studies 

4. Authorizations 


C. Routine Disciplinary 


D. Sex 


D. Language training 


D. Behavior observations 


E. Place of birth 


E. Progress reports 


E. Disciplinary notices 


F. Parent name/address 


F. Directory information 


F. Attendance records not 
otherwise needed 


1 . Pupil residence 

2. Annual verification 

G. Dates of enrollment 

H. Subjects taken 

I. Grades and credits 

J. Immunizations or exceptions 

K. Date of HS graduation 


G. Record rejoinders 

H. Standardized tests less 
than 3 years old 






Access to pupil records is guaranteed only to a 
legal guardian of a currently enrolled or former stu- 
dent. Access privilege is also extended to any student 
who has completed tenth grade, or is 16 or older . 
Finally, access is also granted to any person or group 
given written parental consent. 



i 




2 



Information is taken from "Privacy of Student Records" 
produced by the California Student Information Services 
(CSIS) Project, Far West Laboratory, San Francisco, CA, 
1993 . 

In the state of California. 



Access without parental consent is provided to 
school and district employees and trained volunteers, 
but is restricted to records for which a legitimate edu- 
cational interest exists. This access privilege also 
extends to members of a school attendance review 
board, and officials and employees of a public 
school into which a student intends to enroll. 
However, not all categories of pupil records must be 
forwarded when a student transfers across schools. 
Table 2 documents the categories of information 
which must be provided when a student moves 
between school districts. 
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Table 2. Pupil Record Transfer 



Mandatory Permanent 

Mandatory to: 

California public schools 
Private schools 
Out-of-state public schools 



Mandatory Interim 

Mandatory to: 

California public schools 

Optional to: 

Private schools 
Out-of-state public schools 



Permitted 

Option to: 

California public schools 
Private schools 



Under certain circumstances, access to pupil records 
is also granted to county, state, and federal educa- 
tion officials. Unless state or federal law specifically 
dictates the collection of personally identifiable infor- 
mation, all data collected by these officials must be 
protected so that personal identification of students or 
parents is impossible. Finally, record access is grant- 
ed to any probation officer, district attorney, or prose- 
cuting agency investigating truancy or a criminal mat- 
ter. 

In some instances, personally identifiable information 
from pupil records can be released directly to outside 
agencies without parental consent. One obvious 
example is an emergency, when student information 
must be released to protect the health or safety of a 
student or other person. Agencies processing student 
financial aid applications, or schools involved in 
school accreditation, are also eligible to receive pupil 
records. Finally, organizations conducting studies for, 
or on behalf of, educational agencies may obtain 
copies of pupil records. In each case, however, these 
records are considered privileged information, and 
may not be shared with any person, agency or orga- 
nization other than the one to whom they were origi- 
nally released. 

Any time a personally identifiable portion of a pupil 
record is shared with an outside source, a log of per- 
sons and organizations requesting or receiving infor- 
mation must be maintained. This log is available to 
inspection only by a parent, school official responsi- 
ble for pupil records, or state or federal authority. 
School districts are not obligated to maintain a iog of 
releases of non-personally identifiable pupil informa- 
tion. This allows school districts to release statistical 
data to any public agency, private non-profit college, 
university, or educational research organization with- 
out making an official record of this transaction. 



The following is extracted from Office of 
Information Technology-Security and Risk 
Management Guidelines, Section 6, 
produced by the Department of Finance, 
Office of Information Technology, State of 
California, 1992. 

Guidelines 

6.0 General Comments 

State policy requires that each agency identify the 
automated files and data bases for which it has 
responsibility. The designated owner of the automated 
file or data base is responsible for classifying that 
information. Each agency is also responsible for iden- 
tifying those applications of information technology 
that are critical to agency operations. 

Classifying of information is a statutory obligation. All 
State information falls into one of two categories with 
respect to its disclosure. As defined by the California 
Public Records Act (Government Code Chapter 3.5, 
Sections 6250 through 6265) information either 
"open to the public" or public information, and infor- 
mation which is "not open to the public" or confiden- 
tial information. For purposes of these guidelines the 
terms "public" and "confidential" information will be 
used. 

Classifying information into the categories of public or 
confidential serves to properly indicate, if and when 
and under what conditions, information is to be dis- 
closed. The Public Records Act does not specify what 
security measures or controls are to be used in pro- 
tecting the information. 

In order to provide the proper degree of protection it 
is necessary to further classify information. To resolve 
this problem a third classification called sensitive infor- 
mation has been established which relates to the 
security measures and controls necessary to protect 
either public or confidential information from uninten- 
tional or unauthorized disclosure, modification, 
destruction and/or denial of use. 
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6.1 Public Information 

Public information is all information held by the State 
on which no legal restrictions have been placed 
regarding its disclosure. Public information may be 
further classified as sensitive with regards to the secu- 
rity measures established for its protection and preser- 
vation. 

6.2 Confidential Information 

Confidential information requires special precautions 
to protect it from unauthorized or accidental access, 
disclosure, or dissemination. Automated information 
systems which process confidential data require ade- 
quate controls to safeguard against accidental or 
unauthorized disclosure. Confidential information is 
defined as follow: 

• Information maintained by State agencies that is 
exempt from disclosure under the provisions of 
the California Public Records Act (Government 
Code Section 6250-6265). 

• Information classified as personal by the 
California Information Practices Act of 1977. 

• Information that is exempt from disclosure by 
other applicable State or Federal laws. 

• Information, the disclosure of which is limited by 
contractual obligations, including proprietary 
computer software, proprietary information, and 
trade secrets. 

6.3 Sensitive Information 

Both confidential or public information can be catego- 
rized as sensitive information. Sensitive information 
may require special precautions to protect it from 
unauthorized disclosure, accidental or intentional 
modification, destruction or denial of use. Assigning 
information to sensitivity category helps in defining 
the security measure that is appropriate for its protec- 
tion. 

There are four levels of sensitivity. The sensitivity lev- 
els, SI through S4, refer to the level of protection that 
are warranted for a specific file of information or 
data. It is the departments responsibility to review its 
electronic information with respect to the Public 
Records Act, the Information Practices Act, and other 
State or Federal statutory or regulatory requirements 
which may apply in determining the sensitivity catego- 
ry and the security measures reasonable and prudent 
with respect to the protection of that information. 



S4 Information which if accidentally or intentionally 
disclosed, modified or destroyed would constitute 
an invasion of privacy or result in harm to the 
individual. Information typical of this category 
may consist of medical, financial, welfare infor- 
mation, or records pertaining to pending litiga- 
tion. Operational information or data, such as, 
personal identification numbers, codes or pass- 
words, etc. 

S3 Information which if disclosed, modified or 

destroyed would have a serious negative impact 
on the State operations. Included in this category 
would be financial or investment information. 
Information or data suppled to the State in confi- 
dence, such as, geological or geophysical data, 
plant production or market or crop reports, etc. 

S2 Information which if disclosed, modified or 
destroyed may have an adverse impact on a 
departments activities. Information typical of this 
category are civil service examinations, scoring 
keys, or competitive bids, etc. 

SI Information needed for the day-to-day operation 
of government. Information in this category 
should not contain data which can be related to 
the identity of an individual, result in a negative 
fiscal impact to the State, or adversely impact 
State operations. Information typical of this cate- 
gory is accounting information, statistical informa- 
tion, procedures, policies, published regulations, 
operational directives, etc. 

Sensitivity categories have been established to insure 
adequate levels of protection for the State's informa- 
tional assets. Sensitivity categories also provide a 
convenient means of determining how the information 
is to be handled once it has been printed or distrib- 
uted. For suggest security measures see Table 6.1. 

6.4 Displaying Sensitivity Category 

To insure that the proper degree of protection is 
applied to information that has been printed all 
reports should display the sensitivity category on the 
job separator pages and report heading located at 
the top of each page. 

6.5 Protective Cover 

Reports that are designated sensitive category three 
and four (S3 and S4) are to be placed in a protec- 
tive cover for transport to the proper recipient. 
Depending on the size of the report the protective 
cover can consist of an envelop, box, or cabinet. It is 
not necessary to use a protective cover if report(s) are 
printed in a controlled environment at the recipients 
facility. 
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EXHIBIT 3-2 

An Example of a School District’s Brochure 
About Record Maintenance and Policies 1 

STUDENT RECORDS AND YOUR RIGHTS 



WHAT STUDENT INFORMATION IS 
COLLECTED BY SCHOOLS? 

By state law, the Saint Paul Public Schools must col- 
lect school census information on all students in public 
or private schools if the parents reside in Saint Paul. 
Census information includes student and parent 
names, address, telephone, schools attended, grade, 
school transportation information and special educa- 
tion program assignments. Other information typically 
collected for public schools students includes district- 
wide testing data, subject marks, attendance, and in 
some instances, with approval, special tests or evalu- 
ations by professional staff. 

The Minnesota Department of Education also requires 
the school district to ask for each students Social 
Security Number for state-wide record keeping pur- 
poses. There are no consequences if a student refuses 
to provide the Social Security Number. 

Financial aid to the school district is based on census 
and other information sent to the Minnesota 
Department of Education. 

WHERE IS STUDENT RECORD 
INFORMATION KEPT? 

While a student is enrolled in a Saint Paul Public 
School, official school records are kept at the home 
school in the student's Cumulative Record Folder. This 
folder holds the official student records and other 
data school officials believe is needed to provide the 
best instructional services for each student. 

Census and related administrative information is kept 
in a computerized form at the district's Data 
Processing Department for the Student Data 
Management Department. 



WHO MAY SEE STUDENT RECORDS? 

Access is limited to the following: 

• Parents or legal guardians who present proper 
identification. 

• Students age 1 8 and over who present proper 
identification. 

• Staff members of the Saint Paul Public Schools, 
such as the principal, teachers, counselors, 
school social workers, nurses and other autho- 
rized professional personnel. 

• Other schools, upon request, when a student 
graduates, transfer, or withdraws, unless other- 
wise restricted. 

• Other third parties (employers, social agencies, 
law enforcement, etc.) May have access to 
records only with written permission of adult stu- 
dents, parents, or legal guardians. 

EXCEPTION 

Directory information (name, address, school, birth- 
date, dates of attendance, awards, extra-curricular 
information) is public information and may be 
released. Forms for restricting this information may be 
obtained by calling the Student Data Management 
Department. 

HOW LONG ARE RECORDS KEPT? 

Most records are destroyed when they no longer are 
needed by professional personnel to plan the most 
appropriate instructional programs for students. Many 
evaluative records are destroyed after one year. 
Contents of the Cumulative Record Folder (less the 
permanent records) usually are destroyed within five 
years of the time a student leaves the school system. 
However, a summary of student information along 
with certain grade reporting and attendance data is 
converted to a permanent microfilm record when stu- 
dents leave the school system, as required by law. 
These permanent files are kept to fill requests for infor- 
mation from former students who later need to verify 
school-related information from their own records. 
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Extracted from a brochure developed by Saint Paul Public 
Schools, District 625 — 360 Colborne Street, Saint Paul, 
Minnesota 55102-3299. 
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WHAT HAPPENS TO THE RECORDS WHEN 
A STUDENT LEAVES A SAINT PAUL PUBLIC 
SCHOOL? 



When a student leaves the school system (graduates, 
moves away, withdraws), contents of the Cumulative 
Record Folder are sent to other school systems, col- 
leges, vocational schools, at student request unless 
the parent (or adult student) signs a form specifically 
directing the Saint Paul Public Schools not to release 
information to other schools. This form may be 
obtained from the school at' the time the student 
leaves. After the student leaves, the academic and 
health records are forwarded to the school district's 
Student Data Management Department, where these 
records are microfilmed and preserved. 



WHAT ARE YOUR RIGHTS REGARDING 
STUDENT RECORD INFORMATION? 













State and federal laws governing school records 
allow parents, legal guardians, and adult stu- 
dents (age 18 and over) to examine and/or 
obtain copies of their records or those of their 
children upon proper identification. 

The law requires release of student information to 
a non-custodial parent. Exceptional circumstances 
should be referred to the Student Data 
Management Department. 

You may challenge the accuracy of the record. 
You may request that school officials change it. 
After consultation, school officials may decide 
whether to alter the record. If you disagree, you 
have the right to a hearing. 



WHOM SHOULD YOU CONTACT 
REGARDING QUESTIONS ON RECORD 
PROCEDURE? 

The Assistant Administrator of the Student Data 
Management Department is the person authorized by 
the district to receive concerns about student records 
and may be contacted at 360 Colborne Street, Saint 
Paul, Minnesota 55102. Telephone (612) 293- 
5131. 

Establishing safeguards to protect the right to privacy 
may cause some delay in getting information to the 
source requesting it. However, the school district has 
an obligation to protect the right to privacy for all 
individuals. 



The Saint Paul Public Schools ask your support and 
cooperation with these procedures. If you have ques- 
tions or comments on any of these matters, please 



call 293-5120. 
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SECTION 4 : 

Securing the Privacy of Data Maintained 
and Used within an Agency 

Suggested audiences: 

✓ State education agency staff 

✓ School district staff 

✓ School administrators or staff 

✓ Program and support services staff 

✓ Technical staff 

✓ Teachers and other school-based support professionals 

OVERVIEW 



Many school administrators have nightmares about break-downs 
in the security of their records systems. One administrator might ago- 
nize about the file cabinet key stolen from the school secretary’s desk 
when he or she is at lunch. Another might worry about students 
breaking into the automated management information system to 
change their grades. Still another might cringe at the thought of cer- 
tain student information being released to the media. 

Maintaining the privacy of personally identifiable data about stu- 
dents requires clear policies to restrict who has access to data and 
how the data are used. This section describes some of the considera- 
tions in deciding who can review and use student data, what are 
legitimate uses of data, and what security will be needed to protect 
against inappropriate access. 

COMMONLY ASKED QUESTIONS 



Q. If a student’s record is corrected at the district level, must the 
district inform other holders of that record? 

A. Yes . This is a major part of the importance of a written policy 
regarding what data are maintained and where they are kept. Also 
see Section 5 for changes made to education records as requested 
by parents. 

Q. What should I do when elected officials or others with authority 
over me want to see individual education records? 

A. Unless authorized by law ; the same rules of access apply to 
elected officials as to anyone else outside an agency. When you 
establish policies and procedures on access, the records manager or 
designated official would have the authority to deny unauthorized 
access. You can instruct all other staff members to refer requests to 
the designated official or records manager. See Section 4, 
Guidelines A, B, and E. 
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Q. If some student data are protected and others are not, must I 
keep separate sets of records on students? 

A. No, you are not required to keep separate sets . However, it is a 
good practice and would facilitate monitoring access to the records . 

Q. Does everyone in an agency have access rights to student 
records? 

A . No. See Section 4, Guidelines B for specific guidance. 

Q. Do contractors or vendors for an agency have access rights to 
student records? 

A . Contractors or vendors acting on behalf of the agency or school 
to perform specified duties may be allowed access to those records 
they need to perform such duties. You should consider this kind of 
access case-by-case. Staff from organizations who have access to 
individual data should be trained in their responsibilities to keep 
the data confidential. See Section 4, Guidelines B and E. 

C ■ _ — - I " 

Q. Who can do filing, typing, and data entry of education records? 

A. Agencies or schools may assign these duties to qualified staff 
members. However, it is important to provide training as soon as 
you hire both permanent and temporary staff. The training should 
include the access rights as well as the responsibilities for 
safeguarding the confidentiality of data to which they have access. 
See Section 4, Guidelines C. 

Q- What policies should a school district, regional office, and state 
education agency have in effect? 

A . In addition to the policies required by federal or state laws, you 
should also establish policies that cover how and what data to 
collect; how, where, and how long data are maintained; on what 
criteria individuals within and outside the agency may be given 
access to these data; and how students and parents may review and 
request amendment to the education records. See Sections 3 to 6. 

GUIDELINES 



An official designated 
as the records 
manager should be 
responsible for 
keeping individual 
records safe and 
intact from accidents, 
unauthorized access, 
theft, changes, or 
unintentional release. 



A. Management Responsibilities 

Staff responsible for student data must protect the privacy of the 
data by ensuring that procedures for maintaining the data are secure 
enough to prohibit access to anyone other than the appropriate per- 
sons (those with a need-to-know) and that these procedures are fol- 
lowed. Responsible staff may be the principal of a school, a school 
secretary, computer technicians, a guidance counselor, a school or 
district registrar, the superintendent, or other appointed staff mem- 
bers. These staff members should ensure that education records are 
kept in a locked, fire-proof (preferably), and secure location where 
they cannot be inappropriately read, stolen, or changed. Schools, dis- 
tricts, or state education agencies with individual education records 
maintained in computer files may have a data division with a manag- 
er and staff who are responsible for maintaining the security and pri- 
vacy of education records. 
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No matter what the position, a person with responsibility for the 
confidentiality of education records (e.g., the records manager) has 
serious responsibilities for ensuring that all who work with the data 
will help him or her in guarding the privacy of education records. In 
addition, the records manager should ensure that the equipment and 
procedures used will protect the security of the records. You should 
develop a written policy that describes what data are maintained and 
what procedures are in place to ensure that access to personally iden- 
tifiable data is restricted only to those persons with a legitimate edu- 
cational interest as defined by the system. 

To carry out these management responsibilities, the records man- 
ager must know who is authorized to see personally identifiable stu- 
dent data. A written policy can define the appropriate school officials 
and what constitutes a legitimate educational interest. This policy 
should state who is allowed to change data and what procedures are 
needed to ensure that all records are updated when changes are made. 

Management has a responsibility to inform staff members of their 
rights and responsibilities with regard to student data. One common- 
ly used procedure is to have persons granted access to personally 
identifiable data sign an oath of non-disclosure. This agreement 
should list all types of information that must be kept confidential and 
forbid staff from discussing security aspects of the data system, 
whether a locked filing cabinet or a computer, with unauthorized 
individuals. Specific penalties required by law or regulations should 
be included in this oath. While this may seem extreme, it can help to 
ensure that staff know exactly what the requirements and their 
responsibilities are. 

The selection of equipment and the location for the equipment 
used to maintain student records are important management respon- 
sibilities. Lockable filing cabinets are important for paper documents, 
but maintaining these documents in a safe and monitorable location 
is also essential. You should develop procedures for having the files 
unlocked and available when needed by staff, as well as for securing 
them when not needed. 

For computerized student data, select equipment that has the 
appropriate mechanical configuration, provides access to authorized 
users, and has software that allows the restriction of access to autho- 
rized persons only. Among the procedures used to ensure the privacy 
and security of computer records are password applications that 
restrict access to data elements and files only to those with authoriza- 
tion, frequent password changes to guard against break-ins, and the 
use of encryption. Monitoring access to the secured files is also desir- 
able. Computers can record which users enter into secured files. 

The location of computer equipment should guard against threats 
from intruders as well as physical disasters and other unforeseen 
problems. Computer equipment should be kept in lockable rooms 
with appropriate electrical connections and sufficient space to main- 
tain it. In addition, the equipment should not be located near water 
pipes or other sources of potential disasters. Exhibit 4-1 contains 
additional information about securing automated records. 
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It is more practical to 
establish criteria for 
determining broad 
categories of positions 
than to list exactly 
who or what 
individual positions 
are considered 
“school officials.” 



While agencies or 
schools may establish 
a policy to determine 
what constitutes 
“legitimate 
educational interest,” 
the decision also may 
be made case-by-case. 



B. Defining "Legitimate Educational Interests" 

The Family Educational Rights and Privacy Act (FERPA] makes it 
clear that “school officials with legitimate educational interests” may 
be given access to personally identifiable information about students. 
However the law does not say who those persons are, nor does it stip- 
ulate how to determine the limits of a legitimate educational interest. 
Agencies or schools maintaining personally identifiable data about 
students should have written criteria for determining which school 
officials have a legitimate educational interest in specific education 
records because this must be included in the annual notification to 
parents, as specified in FERPA. The intent to follow this practice 
should be stated in the school’s or agency’s written policy. 

In determining the school officials who might need access to edu- 
cation records, it may be more practical to establish broad position 
criteria than to list exactly who, or what individual positions, qualify. 
General criteria such as these might be useful: 

• A person employed by the agency or school in an administrative, 
counseling, supervisory, academic, student support services, or 
research position, or a support person to these positions 

• A person employed by or under contract to the agency or school 
to perform a special task 

Identifying a person as a school official does not automatically 
grant him or her unlimited access to education records. The existence 
of a legitimate educational interest may need to be determined case- 
by-case. A sample policy statement of what constitutes legitimate 
educational interest might include wording such as the following: 

A school official is determined to have legitimate educational 
interest if the information requested is (l) necessary for that offi- 
cial to perform appropriate tasks that are specified in his or her 
position description or by a contract agreement; (2) used within 
the context of official agency or school business and not for pur- 
poses extraneous to the official’s areas of responsibility or to the 
agency or school; (3) relevant to the accomplishment of some task 
or to a determination about the student; and (4) consistent with 
the purposes for which the data are maintained. 

School officials should be informed that having access to educa- 
tion records or the information within the records does not constitute 
authority to share this information with anyone not given access 
through the written policy. This is particularly critical if the data are 
to be used away from the agency or school by contractors or consul- 
tants. See Section 6 for more information on releasing information 
outside an agency. 

After the policy defines school officials with a legitimate educa- 
tional interest, a list of authorized positions or persons and records or 
specific data elements to which they may have access should be cre- 
ated. This is particularly important if the system is automated. 

Section 3 describes some of the staff members who might have a 
legitimate educational interest. 

If you have any questions about whether a requestor has a legiti- 
mate educational interest, ask the records manager not to disclose the 
information without prior approval from the parents or other appro- 
priate officials. 
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The records manager must decide the legitimacy of each request 
for information. If there is any doubt or question regarding the 
request or the legitimate educational interest, the records manager 
should not disclose the information without the approval or concur- 
rence of appropriate agency or school officials or written permission 
from the student or parent. 

C. Training Agency Staff 

Training all agency staff, even those who do not have access to 
individual education records, is important to ensure that education 
records are handled correctly. Staff members should be informed 
about what is considered appropriate and inappropriate access to the 
data and use of the information within the records. For instance, a 
staff member may have a legitimate access right to a student’s educa- 
tion record for making placement decisions. That same staff member 
may not have a right to view the records of other students for whom 
he or she does not have responsibilities. Persons who are not autho- 
rized to see personally identifiable data should be informed why they 
are denied access if they are in positions where they must work with 
students. 

Plan to train new staff members as soon as possible after they are 
hired. Training should cover the requirements and restrictions under 
FERPA and other relevant federal and state laws regarding confiden- 
tial information (e.g., public health code), and relevant professional 
standards of practice. 

Training should cover any special requirements related to specific 
data collection documents or procedures. Staff should be trained how 
to ask questions, what to do if the person being asked cannot under- 
stand English, how to handle problems when there are misunder- 
standings, exactly what is expected in each data collection document, 
and any other important procedural details. Training should cover the 
responsibility to protect information while it is being collected or 
used. For instance, staff should not leave education record files 
opened on their desks or showing on their computers when they step 
away from their desks. 

D. Professional Ethical Standards 

The use and misuse of student data are covered to some extent by 
professional ethical standards. Several documents should be 
reviewed and considered in this area. Two particularly relevant sets 
of ethical standards are the Ethical Standards for School Counselors 
and Ethics and Law for School Psychologists. Another document is 
the Standards for Educational and Psychological Tests, produced 
jointly by the American Educational Research Association, American 
Psychological Association, and National Council on Measurement in 
Education. This document specifically addresses the use of test 
results. Also, a good resource is The Program Evaluation Standards, 
published by The Joint Committee on Standards for Educational 
Evaluation. These standards describe ethics related to respecting and 
protecting the rights and welfare of human subjects. See the refer- 
ences at the end of this section. 



All staff should be 
trained in 

information security 
as soon as they are 
hired. You should 
inform staff of what is 
considered 
appropriate and 
inappropriate access 
to data and use of the 
information within 
the records. 



Existing professional 
standards are 
invaluable resources 
to support 
policymaking and 
training. 
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It is important to 
determine each time 
whether the staff 
assigned to conduct 
the research are 
trained and 
authorized to access 
the data. An 
alternative approach 
is to sidestep the 
question of security 
by creating a research 
file deleting the 
students’ identifying 
information. 

L ZD 



E. Research Use within an Agency 

Sometimes the records manager will receive requests for research 
using education records, such as comparisons of the test scores of 
students in different programs. District policy or procedures should 
specify the steps in making and acting on such requests. The records 
manager may elect to have staff complete the analysis or contract 
with consultants to do the analysis. If a staff member conducts the 
analysis, it is important to determine if he or she is authorized to 
have access to personally identifiable student data. If not, the records 
manager may create a file containing the needed data without the stu- 
dents’ identifying information. This is a good way to protect confi- 
dentiality while allowing data to be used by contractors or outside 
researchers as well. We describe the release of student data in more 
detail in Section 6. 
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EXHIBIT 4-1 



Some Ways to Promote Secure Maintenance of Automated 

Student Records 



✓ 



✓ 



✓ 




✓ 



✓ 



✓ 




Document the date and reason for collecting 
information for each form and each data ele- 
ment, so that files may be kept current and 
not used for unintended or inappropriate 
purposes. 

Identify education record files and data ele- 
ments within the files as restricted (confi- 
dential) or unrestricted (e.g., directory infor- 
mation). 

Develop a filing system for records, so that 
they can be retrieved easily and accurately 
when needed. The practice will minimize 
the possibility of misplacing confidential 
information and thereby allowing unautho- 
rized access. This is true for either automat- 
ed or paper-record systems. 

Maintain complete and well-documented 
records on all changes and additions to files. 
Computer programs can be used to keep a 
list of changes and additions, note who 
made them, and note when they were made. 

Passwords can be used to limit access to 
parts of student files or to specific data ele- 
ments. Systems operators should monitor 
access closely through a record keeping sys- 
tem. In addition, they should require users 
to change their passwords frequently, at a 
minimum of every three months. 

Where possible, a warning statement should 
appear on the computer screen before access 
is permitted. This statement should stay on 
the screen for at least ten seconds to ensure 
that it is readable. It should be worded to 
convey the following message: 
“Unauthorized access to personally identifi- 
able information is a violation of Federal 

(and/or state) law and will result in 

(prosecution or a maximum fine of $ 

and/or imprisonment of up to years, 

where applicable).” Users should be 
prompted to select whether to proceed. If it 
is not feasible for this statement to appear 



on the screen of the computer, it should be 
typed and attached to the monitor in a 
prominent location. 

✓ When data are maintained on magnetic 
media storage devices, such as tapes, floppy 
diskettes, removable and fixed hard disks, 
they should be secured in the same manner 
as if they were printed materials (e.g., 
locked in a secure cabinet when not in use, 
and only necessary copies made). This may 
require extensive physical security for com- 
puters with hard disks. 

✓ When encryption and decryption are used 
to ensure security of data, the algorithm 
required to encrypt and decrypt must 
receive the same protection as the data. 
When not in use, it must be secured at all 
times. 

✓ To secure data against unauthorized access 
via electronic communication, modems 
should be disconnected while restricted 
data are being stored or processed on micro- 
computers or minicomputers. Extreme care 
should be exercised to ensure that the data 
are not inadvertently made available 
through use of networking technology. For 
example, password protection of access to 
the data file should be required in addition 
to access to the computer. 

✓ Ensure that people involved in coding, 
entering, and processing the information 
have the necessary training and background 
to perform their tasks accurately and main- 
tain strict confidentiality; and ensure they 
understand the criteria, context, penalties 
and other considerations. 

✓ Avoid making excessive copies of back-up 
records. If back-up copies are made, label 
documents as “original” or “copy.” 
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SECTION 5 : 

Providing Parents Access 
to Their Child’s Records 

SUGGESTED AUDIENCES: 

e/! State education agency staff 
%/ School district staff 
i/ School administrators or staff 
Program and support services staff 
Teachers and other school-based support professionals 

OVERVIEW 



Sometimes parents worry about what information is kept about 
their children, and whether the information is correct. To protect the 
privacy of students and their families, the Family Educational Rights 
and Privacy Act (FERPA) grants parents the right to review, amend, 
and challenge the contents of their child’s education record. Section 2 
includes a discussion of FERPA’s requirements; Section 5 provides 
additional suggestions to implement and facilitate the process. 

COMMONLY ASKED QUESTIONS 



Q. Can students review their own records? 

A. Yes , students can review their own records but only under 
certain circumstances . Under FERPA , the right to review records 
transfers from the parents to the students once students turn 
eighteen years old or attend a postsecondary institution . 
Postsecondary students under eighteen may not , however , demand 
access to their elementary or secondary school records . As long as 
students are legally dependent for tax purposes f parents retain 
access rights to records . 

L. . — - ■ — . j 

Q. How do I respond speedily to requests for reviewing student 
records? 

A. If you establish written procedures and provide appropriate 
forms , you can facilitate the reviewing process and forestall 
frustrating delays. See Section 5, Guidelines B. 

Q. Should I authenticate requests for student information? How far 
do my responsibilities extend? 

A. The agencies or schools releasing information are responsible 
for verifying the authenticity of a request However ; you will need 
to make a judgment call as to what precautions are sufficient. You 
can reduce ambiguity by creating a written policy with verification 
procedures. See Section 5, Guidelines C and D for suggestions. 



Section 5: providing parents access to their Child’s Record 



74 



63 



Parents should be 
informed of their 
rights under FERPA, 
although the actual 
means of notification 
is the decision of the 
agency or school. 



Q. Can I discuss the education record of a student in front of 
someone the parent has brought along, such as a language interpreter 
or a friend who sits in when I let the parent review the record? 

A, Yes, you may discuss the record if the parent signs a consent 
form. See Section 5, Guidelines D. 

cr ' -- , ~ ■ - 

Q. Do I have to provide copies of an education record when the 
parents request to see it? 

A. The agency or school may choose to provide copies , although 
this is required only when it is not feasible for the parent to review 
the record because of distance , illnesses, disabilities, or a lack of 
building accessibility . See Section 5, Guidelines E. 

Q. Must I allow a parent to make a copy of an education record? 

A. No, you do not have to allow a parent to make a copy unless the 
agency or school allows copying. The agency or school can charge 
for the copies. See Section 5, Guidelines E. 

Q. Do non-custodial parents have access rights to student records? 

A. Parents, custodial and non-custodial, as well as legal guardians 
have access to student information unless the agency or school has 
evidence of a court order or state law revoking these rights. Parent 
rights extend to surrogate parents of children with disabilities. See 
Exhibit 5-1 for the pamphlet, Rights of Non-Custodial Parents, 
developed by the Family Policy Compliance Office of the U.S. 
Department of Education. 

Q. What do I do if a non-custodial parent requests to amend an 
education record? 

A. You would follow the same procedures as you would for 
amending records for custodial parents. See Exhibit 5-1. 

Q. Must I give my notes on a student to his or her parent? 

A. If teachers' or counselors' notes are not maintained in the 
education record of the student and are not shared with anyone 
else, it is not considered part of the education record by FERPA . 
Teachers may choose not to give their notes to parents. See Section 
2 for the definition of an education record. 

Q. What are the access rights of emancipated minors? 

A. If a person is granted the legal status of an emancipated minor, 
that individual has access to his or her own record. Most states 
define an emancipated minor as a minor who has the power and 
capacity of an adult. 

GUIDELINES 



A. Notifying Parents of Their Rights 

Schools.or districts are required to make public notification of 
parents’ rights under this law. See Exhibit 2-3 in Section 2 for a 
model notification. The actual means of notification (e.g., a special 
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letter, a newsletter article, a PTA or PTO bulletin, or inclusion in a 
student handbook) is the decision of each school or district. In addi- 
tion, the district must attempt to notify parents who have a primary 
or home language other than English. For instance, the notification 
may be translated into different languages, or interpreters may pro- 
vide the information to parents when they are registering their child 
at the school. 



Bo IPr@viidiirag Access If© Sffldovfidyal Hec@rds 

FERPA provides that parents may inspect and review their own 
child’s education record. Exhibit 2-1 includes a Fact Sheet of FERPA 
describing the federal requirements in this aspect. This right of 
review also is granted to non-custodial parents. See Exhibit 5-1. Some 
states established laws with provisions applied to access of education 
records. It is also advisable to check for possible state laws that 
define parents. 

An agency or school may choose to promptly honor a parent’s 
standing request for access. While prompt responses are best, agency 
or school staff should not omit the procedure of verifying the authen- 
ticity of the request. Hence, it is important that agencies or schools 
establish internal management procedures related to handling 
requests from parents to review their child’s record. These procedures 
should describe clearly all steps and the necessary forms, and desig- 
nate the official who handles all requests. This will not only avoid 
confusion among staff at agency or school offices, but also facilitate 
the responding process. 

Co Handling © Parents l^e^yes^ 

Procedures for responding to requests to review individual 
records should be established as part of a district’s student records 
policy. Parents may be asked to submit a written request to review 
their child’s education record. The district may design a sample 
request form or letter. See Exhibit 5-2 for a sample form. The form 
could explain the relevant federal and state laws, describe the access 
procedures, and identify the official designated by the agency or 
school to handle the request. This form should be available at school 
offices, although requests may be directed to the district office. 

Since teachers and other school-based professionals have the 
most frequent contacts with parents, these professionals often receive 
informal requests for information about a student. If the scope of 
these requests is beyond the day-to-day communication about a stu- 
dent and the information can be found only in the education record, 
teachers should refer requesters to the appropriate school or district 
office. This will ensure that all requests are handled appropriately. 

When you receive a written request, verify the requester’s identi- 
fication as soon as possible. Staff could check the education record 
and determine if there is no apparent reason, such as a legally bind- 
ing document, to believe the requester may not have access to the stu- 
dent’s record. Additional procedures may be added to verify the 
authenticity of the request. For instance, staff may call the parents 
using the telephone number listed in the school’s records to verify if 
they have actually made the request. 

76 



It is important for an 
agency or school to 
prepare written 
procedures for 
handling record 
requests. 



The agency or school 
should verify the 
authenticity of 
requests and comply 
within forty-five days. 
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A designated official 
should manage the 
review process. This 
official can verify the 
identification of the 
parents, explain the 
laws, help parents 
understands the 
record, and refer 
parents to 
appropriate 
resources. 



Agencies or schools 
may, but are not 
required to, provide 
copies of the records. 



Since, according to FERPA, an agency or school must comply 
with requests to review a record within forty-five days or less from 
the date of receipt of the request, you should make arrangements for 
access as promptly as possible. FERPA specifies that a school or dis- 
trict may not destroy the record for a student if a request for access to 
that record is pending. It is also advisable to determine if your state 
laws require a quicker response (i.e., fewer than forty-five days). 

D. Managing the Review 

After verifying the legitimacy of a request, the school or agency 
should notify the parent of the time and place to inspect the record. 
See the sample notice in Exhibit 5-3. A school or district staff mem- 
ber may be designated for managing the review. The role of this staff 
member might include: 

• Explaining the laws and regulations that safeguard the confiden- 
tiality of the information 

• Verifying the identification of the requester (through the use of an 
identification with the bearer’s photograph) 

• Staying with the parent during the review to make sure the parent 
understands the contents of the record 

• Making sure the complete record is returned after the review 

• Answering questions about the policies and procedures regarding 
the review 

• Referring the parent to the appropriate resources if a parent has 
further questions about the contents of the record 

At the end of the review, the parents may be asked to sign a form, 
such as the one in Exhibit 5-3, indicating that they have reviewed the 
record. 

Parents may bring another person (e.g., an interpreter, a trusted 
friend, or an attorney) to review the record. The staff member manag- 
ing the review should: 

• Explain the laws and regulations that safeguard the confidentiali- 
ty of the education records, and the penalties to the agency or 
school of unauthorized disclosure. 

• Ask the parent to sign a consent form, such as the one in Exhibit 
5-4, to allow the accompanying person access to the record. 

• Ask the accompanying person to sign an affidavit of non-disclo- 
sure, such as the one in in Exhibit 5-4. 

E. Providing Copies or Charging a Fee 

FERPA does not require agencies or schools to provide copies of 
education records unless there are reasons (e.g., great distance, ill- 
nesses, disabilities, or a lack of building accessibility) it is impossible 
for parents or eligible students to inspect the records in person. A 
school district may establish in its policy whether it will provide 
copies of education records; such policy should specify the circum- 
stances in which copies will not be provided. 

As established in FERPA, the agency or school may not charge for 
search and retrieval of the records. However, it may charge for copies, 
copying time, and postage. Fees for copies of records, including tran- 
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scripts, should be established in the school or district policy and 
publicized as needed. However, the fee imposed should not serve to 
deter parents from reviewing their child’s record. 

The agency or school also may allow the parent who is reviewing 
the records to make copies of parts of the records. If so, it is permissi- 
ble to charge the parent for photocopying costs. 

IF. Handling Challenges to &©c@rd Canton&s 

FERPA also provides parents, custodial or non-custodial, and eli- 
gible students the right to request that a school correct or amend 
records believed to be inaccurate, misleading, or in violation of a stu- 
dent’s right. If the school decides not to amend the record, the parent 
or eligible student has the right to place a statement with the record 
commenting on the contested information. 

A school district should develop a written description of the pro- 
cedures to notify parents and eligible students of their rights to chal- 
lenge record contents and guide them through the process. Parents 
may challenge the contents of the education record and ask that a 
change be made if they believe that the record is inaccurate, mislead- 
ing, or in violation of the privacy rights of the student. In doing this, 
the parents must identify the part of the record they want to change, 
and specify why they believe it to be inaccurate, misleading, or in 
violation of the student’s rights. The parents should make a written 
request to amend the record. The school or district may provide a 
form for this purpose, such as the one in Exhibit 5-5. 

The school or district may decide whether the request is valid. If 
the school or district can verify that the contents in question are in 
error, the record should be amended as soon as possible and the par- 
ent notified in writing of the changes. Exhibit 5-6 contains a sample 
form for this process. 

G. Managing the Hearing Procedures 

A school or district may decide not to make the requested correc- 
tion. If so, you should notify the parents of the decision. The parents 
should be advised of their right to a hearing to challenge the informa- 
tion believed to be inaccurate, misleading, or in violation of the stu- 
dent’s rights. Exhibit 5-7 contains a sample form for this process. The 
parents should be asked to inform the school or district if they would 
like to schedule a hearing to challenge the record. 

The school or district should notify the parents, as soon as feasi- 
ble and reasonably in advance, of the date, location, and time of the 
hearing. The hearing must be presided over by someone who is con- 
sidered a disinterested third party; this person may be a school or 
district employee. The parents must be allowed to present evidence 
relevant to the issues raised in the original request to amend the 
record. The parents may be assisted by other individuals such as an 
attorney. 

When a decision is made about challenged content, the school or 
district should document the evidence presented in the hearing and 
reasons for the decision. The decision should be based solely on the 
evidence presented in the hearing. 



If it is not feasible for 
the parents to review 
the records because of 
distance, you should 
provide a copy of the 
record. 



While agencies or 
schools are not 
allowed to charge for 
the search and 
retrieval of records, 
they may charge for 
copying time and 
postage. 



Written procedures 
can guide parents 
through the process of 
challenging their 
child’s record. The 
school or district may 
provide a form to 
streamline the 
process. 



Parents should be 
notified as soon as a 
hearing is scheduled. 
The hearing may be 
presided over by an 
agency or school 
official, if this person 
is considered a third 
party. 
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Evidence presented in 
the hearing should be 
documented. The 
decision should be 
based solely on the 
evidence presented at 
the hearing. 



It is important to 
follow through on the 
decision of the 
hearing. 



If the decision of the hearing is that the challenged information is 
not inaccurate, not misleading, or not in violation of the student’s 
rights, the school or district must notify the parent. This notification 
must inform the parents that they have a right to place in the record a 
statement commenting on the challenged information or a statement 
setting forth reasons for disagreeing with the decision that the record 
will not be changed. This statement must accompany the record 
when it is transferred to another entity in the future. 

If the decision is that the challenged information is inaccurate, 
misleading, or in violation of the student’s rights, the record must be 
appropriately amended and the school or district must notify the par- 
ent, in writing, that the record has been amended. If the information 
is maintained in portions of the record located in more than one 
place in the school or district, then information in all locations 
should be corrected. 
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Section 5: Providing Parents access to Their Child’s record 



EXHIBIT 5-1 

Rights of Non-Custodial Parents 
in the Family Educational Rights 
and Privacy Act of 1974 1 



The Family Educational Rights and Privacy Act (FERPA) 
sets out requirements designed to protect the privacy 
of parents and students. In brief, the law requires a 
school district to: 1 ) provide a parent access to the 
records that are directly related to the student; 2) pro- 
vide a parent an opportunity to seek correction of the 
record he or she believes to be inaccurate or mis- 
leading; and 3) with some exceptions, obtain the 
written permission of a parent before disclosing infor- 
mation contained in the students education record. 

The definition of parent is found in the FERPA imple- 
menting regulation under 34 CFR 99.3. 

"Parent" means a parent of a student and 
includes a natural parent , a guardian, or an indi- 
vidual acting as a parent in the absence of a 
parent or a guardian. 

Section 99.4 gives an example of the rights of par- 
ents. 

An educational agency or institution shall give full 
rights under the Act to either parent , unless the 
agency or institution has been provided with evi- 
dence that there is a court order, State statute , or 
legally binding document relating to such matters 
as divorce , separation, or custody, that specifical- 
ly revokes these rights. 

This means that, in the case of divorce or separation, 
a school district must provide access to both natural 
parents, custodial and non-custodial, unless there is a 
legally binding document that specifically removes 
that parents FERPA rights. In this context, a legally 
binding document is a court order or other legal 
paper that prohibits access to education record, or 
removes the parents rights to have knowledge about 
his or her child's education. 

Custody or other residential arrangements for a child 
do not, by themselves, affect the FERPA rights of the 
child's parents. One can best understand the FERPA 
position on parents' rights by separating the concept 
of custody from the concept of rights that FERPA gives 
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parents. Custody, as a legal concept, establishes 
where a child will live, and often, the duties of the 
person(s) with whom the child lives. The FERPA, on 
the other hand, simply establishes the parents' right of 
access to and control of education record related to 
the child. 

Here are the answers to questions frequently asked 
about the rights of non-custodial parents. 

1. Does the FERPA require a school to keep a par- 
ent informed of the child's progress even 
though the parent is divorced and living some 
distance from the child? 

No. The FERPA does not require schools to 
inform parents of student progress whether the 
parents are divorced or not. 

2. Does the FERPA require a school to provide a 
parent copies of the record? 

Generally, a school is not required to provide 
parents copies of the record. However, if the dis- 
tance is great enough to make it impractical for 
the parent to visit the school to review the record, 
the school must make copies of the record and 
send them to the parent when that parent 
requests access to the record. 

3. May a school charge for copies of records? 

Yes. A school may charge a reasonable fee for 
copying. 

4. Does the non-custodial parent have the right to 
be informed of and to attend teacher confer- 
ences? 

The FERPA does not address conferences for the 
purpose of discussing student performance. Thus, 
a school has no obligation under this law to 
arrange a conference to accommodate the non- 
custodial parent. However, if records of confer- 
ences are maintained, the non-custodial parent 
has the right to see those records. 

5. Must the school notify the non-custodial parent 
of his/her FERPA rights? 

No. The school would be considered in compli- 
ance with the law if it notifies only the parent 
who has custody of the child. 
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6. Must the school provide the non-custodial par- 
ent the same general notices it provides the 
custodial parent? 

No. General notices, lunch menus, PTA informa- 
tion, announcement of teacher conferences, 
school pictures, and other similar information, are 
not "education records" as defined by the FERPA. 
Therefore, schools are not legally required to pro- 
vide them. 

7. Is the school required to honor a parent's 
"standing request" for access or copies? 

No. The FERPA does not require a school to 
honor a standing request, but the school may do 
so if it wishes. If parents wish to obtain informa- 
tion from their child's record on a regular basis, 
they should submit requests periodically. The 
school must respond to each request within 45 
days. 



8. How can a non-custodial parent get access to 
record? 

Any parent may ask the school for the opportuni- 
ty to review the record, either by going to where 
the record are kept or by requesting copies. The 
school may ask the parent for some identification. 

9. Can the parent with custody prevent the non- 
custodial parent from exercising his or her 
FERPA rights? 

No. FERPA rights are given to both parents. The 
school may assume that a parent has these rights 
unless it has evidence to the contrary. The school 
does not need the permission of the custodial 
parent to give access to the non-custodial parent. 
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EXHIBIT 5-2 

Sample Request to Review 
an Education Record 



Date: 

To: [Name of Designated Official] 

From: [Name of Parent(s)] 

[Address and Phone Number] 

Under the provisions of the Family Educational Rights and Privacy Act of 1974 and [insert applicable 
state/local laws and regulation], I wish to inspect the following education record: 



of [Name of Student]: 

School At Which Student is Attending: 

Requester(s)' Relationship to Student: 

I do /do not desire a copy of such records. I understand that a reasonable fee will be charged for the 

copies. 

Signature: 

For official use only 

Dote Received: Dote Request Verified: 

Approved: Disapproved: Reoson(s) for disapproval: 

Signature of Official Approving/Disapproving Request: 

Date: Dafe Notification Sent: 
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EXHIBIT 5-3 

Sample Notification to Review 
an Education Record 



Date: 

To: [Name of Parent(s)] 

From: [Name of Designated Official] 

Your request for review of your/your child's record was received on [date]. The request was approved. 

The record will be available at the following office for review on [date]: 

[Name and address of office, including room number and contact person] 

As you requested, copies of the record will be mailed to you upon receipt of the copying fee: _ 

Please forward your check, made payable to [appropriate agency], to [address of agency]. 

Please contact [name] of [office] at [telephone number] should you have questions regarding this notice. 
Signature of Designated Official: 



For use on date of review: 

I have reviewed and/ or have been informed of the contents of the requested education record on 

[date] and am satisfied with its accuracy and completeness. 

I have reviewed and/or have been informed of the contents of the requested education record on 

[date]. I am aware that I have the right to request an amendment of all or part of the record if I am not 
satisfied with its accuracy and completeness. I also have received a request form for this purpose. 

Signature of Parent(s): 

Signature of Staff Managing the Review: 



For use in copying/mailing of record: 

Date fee received: 

Date copies mailed: 

Amount received: 



Check No: Staff initials: 

Staff initials: 
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EXHIBIT 5-4 

Sample Consent Form to Allow 
Accompanying Person to Review Record 



For Use by Parent or Eligible Student to Grant Consent 

I hereby grant the permission for [name of person] to accompany me today during my 

review of my/my child's education records. I understand that in doing so, the information maintained in the edu* 
cation records, otherwise protected by [Federal and state laws], may be disclosed with my consent to the 
above named. 

Signature: 

Name: 

Date: 



For Use by Accompanying Person as Affidavit of Non-Disclosure 

In accompanying the above signed parent/guardian on this date during his/her review of the education 
records of [name of student], I will be given access to confidential information maintained in the education 
records of the named student. I understand that this information is protected under [FERPA and state laws, where 
applicable]. I hereby acknowledge that I fully understand that the intentional release by me of this information to 
any unauthorized person could subject me to [penalties where applicable] imposed by [Federal and state 
laws]. 

Signature: 

Name: 

Date: 



For official use only 

Staff initials: Date: 
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EXHIBIT 5-5 

Sample Request to Amend 
an Education Record 



To: [Name of Designated Official] 

From: [Name of Parent(s)] 

I have reviewed my child's education record and believe it contains information that is inaccurate, misleading, 
or in violation of my child's rights. Please amend the record as follows: 

Current record: To be changed to: 



Signature: 

Address: 

Telephone number: 

For official use only: 

Date Received: Request approved: Denied: 

Reason(s) for denial: 

Date of hearing scheduled: Location: 

Date of notification sent: 

Signature of official approving/denying request: 
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EXHIBIT 5-6 

Sample Notification for Approval/ 
Disapproval of Request for Amendment 



Date: 

From: [Name of Designated Official] 

To: [Name of Parent(s)] 

Your request for amendment of the education record of your child, [students name] was received and reviewed. 

The request was approved and necessary changes are made to the specified record as requested. 

The request was denied because ■ 

However, you are entitled to a hearing concerning your request. If you decide to request a hearing, 
please notify the following office within [number of days as specified by state or local policies]: 

[Name of the contact person] 

[Address and telephone number] 

Signature: 
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EXHIBIT 5-7 

Sample Notification for a Hearing 
of Request for Amendment 



To: [Name of Parent(s)] 

From: [Name of Designated Official] 

Date: [Date] 

We have received your request to schedule a hearing for the purpose of challenging the contents of the educa- 
tion records of your child, [name of student]. A hearing is hereby scheduled as below. 

The hearing is scheduled at: 

[Date] 

[Time] 

[Location/Office] 

[Address] 

If you cannot be present on the above date, please contact my office as soon as possible to establish 
a mutually convenient date. 

The hearing is rescheduled at: 

[Date] 

[Time] 

[Location/ Office] 

[Address] 

You shall have a full and fair opportunity to present evidence relevant to the issues you have raised regarding to 
your child's education records. You also may be assisted or represented by individuals of your choice, including 
an attorney. The decision will be based exclusively on the evidence presented at the hearing. 

Please do not hesitate to contact me if you have any question. 



[Name], [Title] 
[Office] 
[Address] 
[Phone number] 
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SECTION 6 : 

Releasing Information 
Outside an Agency 

Suggested audiences: 

State education agency staff 
State or local policymakers 
t/ School district staff 

School administrators or staff 

OVERVIEW 



Managers of education records at the state, local, or school level 
receive numerous requests for information. Every day, they make 
decisions about releasing information. Requests come from the news 
media, businesses, relatives, agency staff, law enforcement units, 
attorneys, private investigators, the governors’ or legislators’ offices, 
or researchers. 

This section supplements Section 2 of this document, which dis- 
cusses the federal laws that govern the release of education records. 
Many states have laws or statutes that further restrict the release of 
these records. School, district, or state education agency staff should 
contact their agencies’ legal counsel or counsel assigned to their 
agency by the state attorney general’s office for legal opinions about 
confidentiality requirements and recommended procedures. This sec- 
tion outlines some general guidelines for deciding whether to release 
information. 

COMMONLY ASKED QUESTIONS 



Q. Who (other than parents) must a school official allow to see an 
education record of a student? 

A. School officials are not required to allow anyone other than the 
parents to see the education records of a student; the exceptions are 
circumstances stipulated by federal or state laws such as 
government-required audits , evaluations , or court orders . See 
Section 6, Guidelines D; see a detailed discussion of the federal 
statutes in Section 2, Guidelines B. 

rr r. - ~J 

Q. Which public officials have access to education records without 
consent of a parent? 

A. School officials and other identified categories of people with a 
“legitimate educational interest 39 in the information have access to 
education records without specific consent of parents or eligible 
students. Policies defining officials who may receive information 
without prior consent must be accessible to parents for review. 
Among those officials are teachers and school officials associated 
with school entrance or transfer; state and local education officials 
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who conduct audits or review records in compliance with federal 
laws; and court officials . 

In some cases , which must be defined by local policy ; third parties 
acting on behalf of schools may also have access to education 
records . Third parties generally include officials in state , local , and 
intermediate administrative units , researchers , psychologists , 
lawyers , or medical practitioners who work for or are under 
contract to schools . 

Q. If a parent makes information about a student public, must 
school officials keep that piece of information confidential? 

A, Yes, school officials should still keep the information private . 
See Section 6, Guidelines C. 

Q. Must a school official release a student’s record to a family 
lawyer? 

A. A school official does not have to release a record of a student 
to his or her family lawyer unless there is a prior written consent 
from the parent See Section 6, Guidelines D. 

Q. What penalties apply to the misuse or improper disclosure of 
confidential information? 

.A. The penalty for non-compliance with the Family Educational 
Rights and Privacy Act (FERPA) and the Protection of Pupil Rights 
Amendment (PPRA) can be withdrawal of U.S. Department of 
Education funds from the institution or agency that has violated the 
law . This applies to schools , school districts , and state education 
agencies . The Family Policy Compliance Office of the US. 
Department of Education , charged with reviewing and investigating 
complaints , seeks to promote voluntary compliance with the law . To 
date, findings of non-compliance have not resulted in such action . 

A third party who improperly discloses personally identifiable 
inf ormation from student records can be prohibited from receiving 
access to records at the education agency or institution for at least 
five years . State laws on privacy may also apply penalties . 

Q. What are the liabilities of a third party’s misuses of education 
records? 

A. School officials are not liable for misuses of data by a third 
party . However, it is important to implement and follow proper 
procedures in good faith to protect the agency or school as well as 
the students and their families. See Section 6, Guidelines G. 

Q. Can student records be transmitted electronically, via the Internet 
and facsimile? 

A. The law requires agencies to prevent the unauthorized release 
of personally identifiable information from education records. 

Thus, when student records are transmitted electronically, 
confidentiality must be protected both by the sender and receiver of 
information. Agencies must establish procedures for releasing 
information, and they must continually train officials and clerical 
staff about their obligation to treat personally identifiable 
information confidentially. 
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Various experts in the application of FERPA and the uses of 
electronic data exchange consider facsimile machines to be less 
secure than the electronic transmission of records. If facsimile 
machines are to be used , the institutions involved with the 
exchange of student information must establish security procedures 
that meet the privacy obligations set out in FERPA. See Section 6, 
Guidelines I. 



GUIDELINES 



A. Types of Information Release 

When a district or school staff member receives an information 
request, the first question he or she needs to consider is what type of 
information is being requested. Generally, information requests about 
one or more individuals can be categorized as non-personally identifi- 
able information or personally identifiable information. 

Non-personally identifiable data do not reveal specific informa- 
tion about a particular individual. They usually describe a group of 
persons (e.g., the aggregate number of students participating in 
extracurricular activities) without identifying any one student. Or, 
they consist of individual records stripped of any information that 
would make it possible to identify the person described. 

Release of non-personally identifiable data is generally allowed. 

A district or school may determine how this type of information is 
released. However, it is advisable to designate appropriate officials 
within the agency to review the compiled data, making sure that no 
single individual can be identified by a combination of several pieces 
of non-personally identifiable information. 

For instance, in reporting test scores for certain racial or ethnic 
groups in a school, if a school has only one student in a particular 
racial or ethnic group at a certain grade level, then that student’s 
score could be made public by combining two separate pieces of 
information. It is important to be aware of the possibility of inadver- 
tently disclosing personally identifiable information even when there 
is more than a single record in a category. 

In planning and producing analyses and tabulations, the general 
rule is that there should be no cell (or category) published in which 
there are fewer than three respondents, or in which personal informa- 
tion could be obtained by subtraction or other simple mathematical 
manipulations. However, this should be adjusted based on the factors 
unique to the district or school, such as the size of the school or com- 
munity population. You must also be careful not to allow information 
to be disclosed through subsequent cross tabulation of the same data 
with other variables. 

Personally identifiable data may or may not identify a person 
directly, but contain information that would make students’ identities 
and any related information about them easily recognized. This infor- 
mation is more sensitive than grouped information or summarized 
data and therefore requires more attention and care before release. 
Personally identifiable information, including the identifying data 
listed below, must be maintained in education records that are pro- 
tected with appropriate security. It is important that state or local 



Non-personally 
identifiable data do 
not reveal specific 
information about an 
individual. Release of 
this type of data is 
generally allowed. 



Personally 
identifiable data are 
those that contain 
information that 
would make the 
student’s identity and 
any related 
information about 
him or her easily 
recognized. Release of 
this type of data is 
subject to established 
policy in the school 
district, as well as 
state and federal 
laws. 
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State and local laws 
may specify what 
types of information 
are considered 
directory information, 
which may be 
released without 
prior consent. 
However, parents 
must be informed of 
what is considered 
directory information 
and given the 
opportunity to 
withhold its release. 



education agencies establish policies that define personally identifi- 
able information and list specific examples. This will avoid confu- 
sion when actual information requests are handled. 

Personally identifiable data include identifying data that directly 
associate with a person, such as the following: 

• A person’s name 

• The name of the student’s parent or other family members 

• The address of the student’s parent or other family members 

• The telephone number of a person 

• A photograph of a person 

• An identifier, such as a person’s social security number or an 
identification number assigned by the school 

• A list of personal characteristics (e.g., apparent disability, a birth- 
mark, or race and ethnicity) that would make the person’s identi- 
ty easily traceable 

• Other information that would make the person’s identity easily 
traceable 

Some types of identifying data may be defined as part of the 
directory information in a district’s education records policy. Staff 
should check with the policy for the proper release of this type of 
information. Section 6, Guidelines B discusses directory information 
and its proper release. 

B. Release of Directory Information 

If information requests are related to personally identifiable stu- 
dent information to be obtained from the education records, the first 
question you should ask is whether the request is for directory infor- 
mation as defined in the district’s education records policies. Section 
2 of this document contains definitions of education records and 
directory information , as well as federal regulations that relate to the 
release of this information. 

Agency or school staff should refer to federal, state, and local 
laws and regulations about the types of data that may be released 
without consent of the parents. State and local laws may specify data 
items considered directory information. Section 2, Guidelines B 
includes the types of items that are typically considered directory 
information by local policies. 

As required by FERPA, annual notification should be given to 
allow parents to request that all or portions of directory information 
not be released. Exhibit 6-1 contains a sample notification form. 

Upon receipt of an information request, district or school staff need 
to verify that there is an appropriate, prior consent to release that 
piece of information about the student(s). 

C. Release with Prior Consent 

When requested by a third party (e.g., from a relative, family 
lawyer, or a news reporter) for individual information not authorized 
by FERPA or other federal laws such as the National School Lunch 
Act (NSLA), the requester should be required to present written con- 
sent from the parent. If information requested from the record is not 
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considered directory information but is personally identifiable, it can 
be released if the parent provides a written , signed , and dated con- 
sent document. The document must: 

• Specify the information that may be released 

• State the purpose of the release 

• Identify the individuals or entities to whom the release may be 

made 

Staff processing the request should make sure that the consent is 
genuine and should be ready to contact the parent for verification if 
there is any question or doubt about its authenticity. 

Unless otherwise allowed by federal or state law, or local policies, 
agency or school staff should not assume that if parents openly dis- 
cuss information included in their child’s education records, the par- 
ents are giving “implied” consent for staff to release that information. 
Written consent for agency or school release from the parent is 
required by FERPA. 

D. Release without Prior Consent 

Without prior written consent from the parent, personally identi- 
fiable information maybe released to particular individuals or enti- 
ties outside the agency or school. Such release must be allowed by an 
established policy. Agency or school staff should be familiar with fed- 
eral and state laws as well as local policies established in this regard, 
and understand that they are not required to release information 
unless otherwise specified by these laws or policies, but are given the 
option to do so. Section 2 lists these outside individuals or entities to 
whom student records may be released. Examples of these individu- 
als include designated, authorized representatives from state and 
local education agencies, the juvenile justice system, and health or 
safety personnel in case of an emergency. Exhibit 6-2 includes a form 
that an agency or school could use to monitor this type of release. 

Within the agency or school, education records may be released 
and used by personnel who are considered to have a legitimate edu- 
cational interest or need-to-know without prior written consent of the 
parent. Section 4 contains guidelines regarding this type of release. 
Examples of personnel who may have authorized access to the stu- 
dent records include research and evaluation directors and service 
providers or coordinators of special programs in which the students 
participate. 

The NSLA allows the release of free and reduced-price school 
meal eligibility without consent of the parent for certain purposes. 

We discuss this issue in Section 2. Agencies or schools should estab- 
lish written guidelines to permit such release. 

E. Release to Researchers 

In some cases, researchers who are not employed by the agency 
or school may be authorized to conduct data processing or research 
and evaluation studies through contractual arrangements. If these 
efforts are initiated by and performed on behalf of the agency or 
school, researchers may be considered school officials who have a 
legitimate educational interest. We discuss these situations in Section 



Non-directory 
information can be 
released with written 
consent from the 
parent. The consent 
should specify the 
information that may 
be released, the 
purpose of the 
release, and the 
recipient. 



Personally 
identifiable 
information may be ' 
released as 
authorized in 
established policies 
and federal or state 
law or regulations. 
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Information about a 
student’s eligibility 
for free and reduced- 
price school meals 
may be released only 
as authorized under 
the NSLA and its 
regulations. 



Requests from 
researchers should be 
handled case-by-case. 
You should establish 
a set of criteria, 
application 
procedures, and 
written guidelines for 
making the decision. 



4. However, researchers outside the agency or school often request 
individual information for their own research agendas. More often 
than not, the requested information includes more than one data item 
from the education records or student database. These requests 
should be handled case-by-case. Agency or school officials should 
establish criteria for considering such requests. These criteria may 
take into consideration the perceived benefits of the research, the 
potential invasion of students’ privacy, the reputation of the 
requestor, or the availability of staff to monitor the process of the 
release and the research activities. 

In general, the release of data to researchers outside the agency 
should be considered as a loan of data (i.e., recipients do not have 
ownership of the data). Agencies or schools could request that these 
data be returned or copies destroyed when the researchers complete 
their work. 

Before considering these data requests, agencies should establish 
written guidelines and procedures to allow the on-site access or off- 
site loan of personally identifiable data by appropriate individuals or 
organizations. In 1993, the National Center for Education Statistics 
(NCES) of the U.S. Department of Education published a manual, 
called Field Restricted Use Data Procedures , to ensure the implemen- 
tation of proper procedures before releasing any of its data sets. The 
following items, adapted from the NCES manual, could be included 
in an agency’s policies and procedures regarding the loan of data: 

• Description of all the federal and state laws and regulations gov- 
erning the access to the data and penalties for violation 

• Procedures to request access to or loan of data and name of the 
official designated to handle the request 

• Criteria for accepting or denying requests 

• Minimum expected security requirements 

• Allowance for unannounced, unscheduled inspections of the data 
user’s site 

• Other relevant requirements 

Organizations that intend to obtain access to personally identifi- 
able data could be required to submit a formal, written application on 
the organization letterhead including: 

• Type of data (with specific items listed) requested 

• Reasons for requesting the data 

• A description of how the data will be used and analyzed 

• A description of how analyses will be presented and reported 

• Name and titles of (l) the official(s) with the authority to bind the 
requesting organization to the agreement; (2) the official(s) in 
charge of the day-to-day operations involving the use of the data; 
and (3) the professional and support staff who conduct the 
research and analysis as well as those who may have access to 
the data 

• Estimated amount of time the data are needed 

• Desired medium of release (e.g., paper or media format) 
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In addition, the organizations requesting access or loan of data 
should submit a security plan addressing all applicable security pro- 
cedures. These procedures may include: 

• Computer security — use and update passwords; implement log- 
on procedures with automatic security data access shut-down 
function; assign access security levels; integrate warning state- 
ments; prevent external access to any modems connected to the 
system while processing data on a computer; and use additional 
procedures to safeguard the data in networked environments. If a 
one-time complete backup copy of the data will be needed, the 
applicant should also explain the security procedures surround- 
ing the backup copy of the data, including those backup copies 
that are created automatically while downloading. 

• Physical handling and storage of data — catalogue and storage 
with lock and key; minimal allowance and secured storage of 
printed copies; and additional restrictions on copying of data. 

• Transportation of data — ideally by a bonded courier and notice 
of confidentiality and restricted use. 

Agencies must proceed with caution before releasing portions of 
databases containing individual education records. Under most cases, 
the release of database information with personally identifiable infor- 
mation is restricted by law. If a request is approved, agency or school 
staff should extract only the data approved for release and make sure 
they are non-personally identifiable. However, as mentioned earlier 
in this section, non-personally identifiable data may become poten- 
tially personally identifiable. 

Before a data set is released across agencies or to researchers or 
research institutions, appropriate agreements must be signed to 
ensure that all records will remain private, the conditions of release 
and re-release are well defined and limited, and penalties for inap- 
propriate records use or release of records are stated clearly. 
Individuals employed by the agencies who are authorized and who 
will have access to the individually identifiable information also 
could be required to sign an affidavit of non-release. Exhibit 6-3 con- 
tains a sample form. 

In most cases, information indicating that an education record 
has been released must be documented in the record and retained 
there until the education record is destroyed. 

F. Release to Other Service Agencies 

There are increasing needs for education and other service agen- 
cies to develop coordinated data systems that enable them to more 
effectively and efficiently serve children and their families. Many 
agencies, such as education, health, social service, and labor agen- 
cies, are seeking means to facilitate the automatic accessibility of 
information from student records mainly for these purposes: 

• To facilitate agency program planning and evaluations of educa- 
tion programs 

• To protect the health and safety of students, in schools 

• To increase the efficiency of services, especially supportive ser- 
vices for children and youth 
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Agencies are 
developing strategies 
which establish the 
kinds of privacy 
standards and 
procedures that 
would ensure the 
confidentiality of 
information while 
allowing restricted 
use of information for 
specific and pre- 
approved purposes. 



• To conduct evaluations of education programs and studies of 
workforce preparedness, and school-to-work links 

Institutional sharing of information requires that agencies estab- 
lish memoranda of understanding or legal agreements among agencies 
to confirm what and how data will be exchanged and used, and that 
they maintain records of what information has been shared and the 
authorization for sharing it. In addition, agencies must adequately 
train the staff who use the information and specify how they secure 
both electronic and paper files. The following examples are strategies 
for protecting the confidentiality of information used across agencies: 

• Agencies that collaborate for in-take procedures, direct service, or 
research explicitly spell out procedures for obtaining informed 
consent and define in advance what data will be shared, how 
they are used, and the means of ensuring privacy if they are 
released from the originating agency. 

• When research studies are to be conducted, information from sev- 
eral agencies can be analyzed within the education agency ; fol- 
lowing adequate privacy safeguards, so that no identifiable infor- 
mation is available to individual researchers or analysts. 

• Data are matched electronically so that personally identifiable 
information from several data sources is connected within the 
computer and not actually seen. In these cases, personal informa- 
tion is only used to produce aggregate results for groups and pro- 
grams. 

Cross-agency partnerships have been developing during the past 
decade. Although they are limited by some practical, political, tech- 
nical, and regulatory barriers, service providers and policy analysts 
agree that the following benefits and efficiencies can be gained from 
sharing data for at least these three well-defined purposes: 

• Providing children with supportive services — Counselors and 
health services providers may need information about an individ- 
ual’s social, educational, and health status to diagnose a problem 
and develop and implement a treatment plan. Records kept in 
schools (e.g., attendance information, family background, and 
reports of academic and behavioral achievements or problems) 
can contribute critical information for case planning and manage- 
ment. Some information may help law enforcement officials 
locate youth involved in the juvenile justice system who may 
need assistance or who may be a danger to themselves or those 
around them. 

• Increasing access to social and educational service — Sometimes 
agencies need to seek or verify eligible program participants. 

Often there are children in schools whose families may not real- 
ize they are eligible for certain assistance (e.g., free or reduced- 
price lunch, health, or welfare services) that is available through 
school or community agencies. Records of several service agen- 
cies may need to be cross-checked to increase the efficiency of 
deciding what services are available and to ensure those services 
reach the individuals who need them. 
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• Conducting policy planning and evaluation studies — Student 
records that are part of education agencies’ administrative struc- 
tures can inform statistical studies for improving management of 
services and evaluating outcomes. A start toward using integrated 
electronic records systems for management and outcomes evalua- 
tion is occurring in several states. In each instance, the states’ leg- 
islatures have encouraged the development of integrated data sys- 
tems to strengthen, evaluate, or manage integrated public services 
or to improve access to evaluation and planning information to 
support workforce development programs. The systems are 
emerging very slowly, typically following an investment in con- 
sensus-building procedures that include members of all contribut- 
ing agencies in planning. No exchange of information occurs until 
appropriate memoranda of agreement are in place, along with 
procedures for obtaining the consent of participating individuals 
or verifying that such consents are unnecessary because no confi- 
dential or personally identifiable information is used at the indi- 
vidual case level. 

Education agencies are finding new ways to support services inte- 
gration for students while they meet their legal and ethical obliga- 
tions to restrict the release of information from student records. One 
way this occurs is for agencies to guide data sharing with well- 
defined policies for gaining consent to use records across agencies at 
the time that records are initially established. In general, information 
about students can be released only with the signed consent of par- 
ents or eligible students who have been told, in language they under- 
stand, what information is to be used across agencies, why, and how 
that sharing will occur. 

In any instance of data sharing, agencies must be especially care- 
ful to maintain a clear distinction between the data collected for 
research, evaluation, and regulatory purposes, and data collected for 
clinical uses. The protection of privacy and data accuracy are essen- 
tial to any data coordination efforts. However, these protections do 
not have to be absolute barriers to data coordination. A first step to 
cross-agency coordination of services and policy analysis is to estab- 
lish well-defined procedures that maintain distinctions between dif- 
ferent types of data and their uses and ensure that education agency 
managers and staff who work with student records understand confi- 
dentiality restrictions and procedures for handling private, personally 
identifiable information. A thorough knowledge of the rationale 
behind federal, state, and local privacy laws and an understanding of 
what the laws allow and disallow, are the building blocks of widely 
sought interagency data coordination. 

As cross-agency partnerships become established, many issues 
other than confidentiality requirements need to be addressed. As of 
the date of this publication, such efforts are either at the planning or 
early implementation stages. It is therefore premature to include best- 
practice guidelines consistent with the purposes of this document. 
The National Forum on Education Statistics will continue to work 
with state and local education agencies, exploring the issues and 
identifying effective practices of interagency data sharing in 1997. 
Results of this effort will be published in a separate document. 



Interagency sharing 
of information from 
students’ education 
records generally 
requires a signed 
release by parents or 
eligible students, 
regardless of whether 
the records originate 
in schools, health 
centers, and 
employment or social 
service agencies. 
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As a final security 
control, a designated 
official could review 
the compiled data 
and verify that local 
procedures have been 
followed, before 
approving the release. 



Recipients should be 
required to sign an 
affidavit that they 
will not release any 
personally 
identifiable 
information received. 



It is important for you 
to document data 
releases whether or 
not prior consent was 
required. This 
information should 
remain in the record 
as long as you 
maintain the record. 
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G. Review Prior to Release 

As a final control, an appropriate official could review the com- 
piled information or data for accuracy and to ensure they are within 
the scope approved for release. This official also may review the pro- 
cedures to ensure compliance with all federal, state, and local 
statutes, rules, and regulations that apply to the release. Signatures of 
the appropriate and authorized persons should be required for every 
release. 

H. Avoid Misuse of Information by Non-Intended 
or Secondary Users 

Any organization creating, maintaining, using, or disseminating 
education records with personally identifiable data must assess the 
reliability of the information for its intended use and must take pre- 
cautions to prevent misuse of the data. When data are released to 
individuals or groups outside the agency, the recipients should be 
required to sign an affidavit stating that they will use the data in a 
way consistent with that described in their requests, and not to trans- 
fer or re-release the data to another individual or organization. 

Exhibit 6-4 contains a sample statement. Although school officials are 
not liable for a third party’s misuses of data, it is important to imple- 
ment and follow proper procedures in good faith to protect the stu- 
dents and their families as well as the agency or school. 

I. Document the Release 

Agencies or schools should maintain records of access, retrieval, 
or release of records, including the names of persons retrieving 
records and the purposes for each release, and should maintain a list 
of personnel authorized to have access to the file. They should also 
maintain a record of user requests for data that have been denied or 
only partially fulfilled. Such information can be used for periodic 
reviews of agency confidentiality and data release policies. 

Information about releases with or without prior consent of the 
parent should remain with the education record as long as the record 
is maintained. It is a good practice to document all access and 
release. However, it is not required if the request was made by, or 
release was made to: 

• The parent or eligible student 

• A school official who has been determined to have a legitimate 
educational interest 

• A requester with written consent from the parent or student 

• A requester seeking directory information only 

J. Ensure the Security of Data in Electronic 
Transmission 

Particular attention should be given to confidentiality when data 
are released through electronic means because of the increased poten- 
tial for unauthorized access. For example, you cannot visually check 
the photo identification of a facsimile or electronic mail recipient. 
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You must establish policies and procedures to address the issue of 
data forwarding via electronic means. 



You should routinely embed various levels of encrypted codes 
into computerized databases. This will protect the confidentiality of 
the data as well as ensure the integrity and authenticity of the infor- 
mation. You should establish clear rules and procedures about who 
can send and who can receive and use data. In addition, you could 
specify the penalties for abuse or misuse of systems. 



It is important for the electronic system to log the transfer of per- 
sonally identifiable data in a security audit trail to account for releas- 
es of data by and to appropriate individuals. The use of electronic 
authentication programs can reassure the sending agency or school 
that the information has reached the appropriate recipient and that 
no changes to the contents have been made. 



You should establish 
policies to cover 
instances in which 
information may be 
released through 
electronic means. You 
can use a variety of 
methods to safeguard 
the data, including 
encryption and 
passwords, and 
careful logging of a 
transfer. 
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EXHIBIT 6-1 

Sample Request to Withhold Release 
of Directory Information 1 



To: All parents School Year 

The items listed below are designated as ''directory information" of [name of agency or school] and may be 
released for any purpose at the discretion of [name of agency or school]. [Cite state laws and regulations or 
local policies where applicable.] Under the provisions of the Family Educational Rights and Privacy Act of 
1 974, as amended, you have the right to withhold the release of any or all of the information listed below. 

[Listed below are example of Directory Information] 

Name of student 

Address of student 

Telephone number of student 

Earned awards and degrees of student 

Participation in officially recognized activities and sports 

Weight and height of members of athletic teams 

Degrees and awards received 

Photograph 

Others: 



Please consider very carefully your decision to withhold any item of "directory information." Should you decide 
to inform [name of agency or school] not to release any or all of the items listed below, any future requests for 
such information from individuals or entities not affiliated with the [name of agency or school] will be refused. 
Please indicate here your request to withhold any or all of the above items: 



If this form is not received in [name of office] prior to [date], it will be assumed that the above information may 
be released for the remainder of the current school year. A new form for non-release must be completed each 
[term/ semester/year]. 

Parents Name: Student's Name: 



Signature: 



Date: 



Adopted from American Association of Collegiate Registrars 
and Admissions Officers, Guidelines for Postsecondary 
Institutions for Implementation of the Family Educational Rights 
and Privacy Act of 1974 as Amended, Revised Edition, 



1995. 
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EXHIBIT 6-2 

Sample Request of Non-Parent 
for Access to Education Record 



To: [Name of designated official] 

From: 

[Name, title, organization] 

I hereby request permission to examine the following part(s): 



of the official education records of: [name(s) of student], student(s) at: 

[name of agency or school], I certify that I am (check one as appropriate): 

An authorized official of another school system in which the student intends to enroll. 

An authorized representative of the Comptroller General of the United States. 

An authorized official of the financial institution to which the student applied to receive financial aid. 

The purpose of this request is to determine eligibility, amount of aid, conditions of aid award, and 
enforcement of award terms and conditions. 

An authorized official of an accrediting organization. I understand that release is allowed on the 

conditions only appropriate members of my organization view the records, and resulting studies do not 
identify any particular student. 

An authorized representative of the Secretary of the U.S. Department of Education. 

[Add other categories as allowed in state or local laws and regulations.] 

I agree that no unauthorized person or organization will have access to any records or information obtained 
through this request without the written permission of the parents of the student or the student. I understand the 
maximum penalties for re-disclosure of the record will be [as set forth by federal and state laws and regula- 
tions]. 

Signature: Date: 



For official use only: 

Request approved/denied by: Date: 
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EXHIBIT 6-3 

Sample Affidavit of Non-Release 
by Researchers 



I, [name of individual], do solemnly [swear or affirm] that when given access to the [title of data to be provid- 
ed] provided by [name of the agency or school], I shall not: 

1 . Use or reveal any personally identifiable information furnished, acquired, retrieved, or assembled by 
me or others, under the provisions of [citation of applicable laws] for any purpose other than statistical 
purposes specified in the [name of agreement]; 



2. Make any release or publication whereby an individual could be identified or the data furnished by or 
related to any particular person can be identified; or 

3. Permit anyone other than the individuals authorized by [name of the agency or school] to examine the 
individual reports. 



Signature: 



Name: 



Title: 

Organization: 

Date: 

The penalty for unlawful release is [maximum penalties as specified by the applicable laws and provide cita- 
tions]. 

Notary Public and Seal: 
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EXHIBIT 6-4 

Sample Statement of Non-Disclosure 
of Released Information 



I understand that upon receipt of the information provided by [name of agency or school] regarding [type of 
information] about [name of student(s)], the re-release of which is prohibited by the Family Educational Rights 
and Privacy Act of 1974 [and cite state or local laws, where applicable], I acknowledge that I fully understand 
that the intentional release by me of this information to any unauthorized person could subject me to [criminal 
and civil penalties, where applicable] imposed by law. 



Signature: 



Name: 



Title: 



Organization: 



Date: 



1 
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APPENDIX A 

A Brochure: 

Protecting the Privacy of Student Education Records 1 



Student education records are official and 
confidential documents protected by one of the 
nation’s strongest privacy protection laws, the 
Family Educational Rights and Privacy Act 
(FERPA). FERPA, also known as the Buckley 
Amendment, defines education records as all 
records that schools or education agencies main- 
tain about students. 

FERPA gives parents (as well as students in 
postsecondary schools) the right to review and 
confirm the accuracy of education records. This 
and other United States “privacy” laws ensure 
that information about citizens collected by 
schools and government agencies can be 
released only for specific and legally defined 
purposes. Since enacting FERPA in 1974, 
Congress has strengthened privacy safeguards of 
education records through this law, refining and 
clarifying family rights and agency responsibili- 
ties to protect those rights. 

FERPA’s legal statute citation can be found 
in the U.S. Code (20 USC 1232g), which incor- 
porates all amendments to FERPA. FERPA regu- 
lations are found in the Federal Register (34 
CFR Part 99). FERPA’s 1994 amendments are 
found in Public Law (PL.) 103-382. 

FERPA Protects Privacy 

FERPA applies to public schools and state 
or local education agencies that receive Federal 
education funds, and it protects both paper and 
computerized records. In addition to the Federal 



This document was prepared by Policy Studies Associates, 

Inc. under contract to the Council of Chief State School 
Officers. The document was printed by the National Center 
for Education Statistics for the National Forum on Education 
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well as professional associations and federal agencies that 
are users or providers of education data. The views 
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should be inferred. The document has been revised in accor- 
dance with the final regulations implementing Section 249 of 
the Improving America Schools Act, Federal Register, Vol. 61 
(226), Thursday, November 21, 1996, pp. 59291-59298. 



laws that restrict disclosure of information from 
student records, most states also have privacy 
protection laws that reinforce FERPA. State laws 
can supplement FERPA, but compliance with 
FERPA is necessary if schools are to continue to 
be eligible to receive Federal education funds. 

FERPA requires schools and local education 
agencies to annually notify parents of their 
rights under FERPA. The notice must effectively 
inform parents with disabilities or who have a 
primary home language other than English. The 
annual notice pertaining to FERPA rights must 
explain that parents may inspect and review 
records and, if they believe the records to be 
inaccurate, they may seek to amend them. 
Parents also have the right to consent to disclo- 
sures of personally identifiable information in 
the record, except under authorized circum- 
stances. 

FERPA gives both parents, custodial and 
noncustodial, equal access to student informa- 
tion unless the school has evidence of a court 
order or state law revoking these rights. When 
students reach the age of 18, or when they 
become students at postsecondary education 
institutions, they become “eligible students” 
and rights under FERPA transfer to them. 
However, parents retain access to student 
records of children who are their dependents for 
tax purposes. 

FERPA Defines an Education Record 

Education records include a range of infor- 
mation about a student that is maintained in 
schools in any recorded way, such as handwrit- 
ing, print, computer media, video or audio tape, 
film, microfilm, and microfiche. Examples are: 

• Date and place of birth, parent(s) and/or 
guardian addresses, and where parents can 
be contacted in emergencies; 

• Grades, test scores, courses taken, academic 
specializations and activities, and official 
letters regarding a student’s status in school; 

• Special education records; 
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• Disciplinary records; 

• Medical and health records that the school 
creates or collects and maintains; 

• Documentation of attendance, schools 
attended, courses taken, awards conferred, 
and degrees earned; 

• Personal information such as a student’s 
identification code, social security number, 
picture, or other information that would 
make it easy to identify or locate a student. 

Personal notes made by teachers and other 
school officials that are not shared with others 
are not considered education records. 
Additionally, law enforcement records created 
and maintained by a school or district’s law 
enforcement unit are not education records. 

Part of the education record, known as 
directory information, includes personal infor- 
mation about a student that can be made public 
according to a school system’s student records 
policy. Directory information may include a stu- 
dent’s name, address, and telephone number, 
and other information typically found in school 
yearbooks or athletic programs. Other examples 
are names and pictures of participants in vari- 
ous extracurricular activities or recipients of 
awards, pictures of students, and height and 
weight of athletes. 

Each year schools must give parents public 
notice of the types of information designated as 
directory information. By a specified time after 
parents are notified of their review rights, par- 
ents may ask to remove all or part of the infor- 
mation on their child that they do not wish to 
be available to the public without their consent. 

FERPA Guarantees Parent Review and 
Appeal 

If, upon review, parents find an education 
record is inaccurate or misleading, they may 
request changes or corrections, and schools and 
education agencies must respond promptly to 
these requests. 

Requests should be made in writing, accord- 
ing to an agency’s annual notice of procedures 
for exercising rights to amend records. Within a 
reasonable time period, the school or agency 
must decide if the request to change a record is 
consistent with its own assessment of the accu- 
racy of the record. If a parent’s request is 
denied, he or she must be offered the opportuni- 
ty for a hearing. If the disagreement with the 
record continues after the hearing, the parent 



may insert an explanation of the objection in the 
record. FERPA’s provisions do not apply to 
grades and educational decisions about children 
that school personnel make. 

While parents have a right to review 
records, schools are not required by Federal law 
to provide copies of information, unless provid- 
ing copies would be the only way of giving par- 
ents access. Schools may charge a reasonable fee 
for obtaining records, and they may not destroy 
records if a request for access is pending. 

FERPA Restricts Disclosure of Student 
Records 

Local education agencies and schools may 
release information from students’ education 
records with the prior written consent of par- 
ents, under limited conditions specified by law, 
or as stated in local agencies’ student records 
policies. The same rules restricting disclosures 
apply to records maintained by third parties act- 
ing on behalf of schools, such as state and local 
education agencies, intermediate administrative 
units, researchers, psychologists, or medical 
practitioners who work for or are under contract 
to schools. 

If an education agency or a school district 
has a policy of disclosing records, it must speci- 
fy the criteria for determining school officials 
within an agency, including teachers, who have 
a legitimate educational interest. Generally, 
school officials have legitimate educational 
interest if they need to review an education 
record to fulfill their professional responsibili- 
ties. 

Teachers and school officials who work with 
the students and schools to which students 
apply for entrance may also have access to edu- 
cation records without prior consent of the par- 
ent. In addition, information from students’ 
records may be released to state and local edu- 
cation officials to conduct audits or to review 
records in compliance with Federal laws. 
Schools may also disclose information from 
education records without the consent of par- 
ents in response to subpoenas or court orders. A 
school official must make a reasonable effort to 
notify the parent before complying with the sub- 
poena unless the subpoena is issued to enforce a 
law and specifies not to notify the parent. In 
emergencies, school officials can provide infor- 
mation from education records to protect the 
health or safety of the student or others. 
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There are cases when schools or school sys- 
tems decide it is in the public interest to partici- 
pate in policy evaluations or research studies. If 
student records are to be released for these pur- 
poses, the school or school system must obtain 
prior consent of the parent. Signed and dated 
written consent must: 

• Specify the records that will be released; 

• State the reason for releasing the records; 

• Identify the groups or individuals who will 
receive the records. 

In general, information about each request 
for records access and each disclosure of infor- 
mation from an education record must be main- 
tained as part of the record until the school or 
agency destroys the education record. Outside 
parties receiving records must receive a written 
explanation of the restrictions on the re-release 
of information. 

Additional FERPA Provisions 

In 1994, the Improving America’s Schools 
Act amended several components of FERPA, 
tightening privacy assurances for students and 
families. The amendments apply to the follow- 
ing key areas: 

• Parents have the right to review the educa- 
tion records of their children maintained by 
state education agencies; 



• Any third party that inappropriately re- 
releases personally identifiable information 
from an education record cannot have 
access to education records for five years; 

• Information about disciplinary actions taken 
against students may be shared, without 
prior consent of the parent, with officials in 
other education institutions; 

• Schools may release records in compliance 
with certain law enforcement judicial orders 
and subpoenas without notifying parents. 

Questions? Call the Local School System, 
State Education Agency, or the Federal 
Family Policy Compliance Office. 

School districts, state education agencies, 
and the U.S. Department of Education all offer 
assistance about FERPA. Before contacting 
Federal officials, however, you can offer get a 
direct and immediate response from your local 
or state education officials. 

The Family Policy Compliance Office can 

be reached at the following address: 

U.S. Department of Education 
600 Independent Avenue, SW 
Washington, DC 20202-4605 
(202) 260-3887 
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APPENDIX B 

Final Regulations 9 

on Family Educational Rights and Privacy Act 
Federal Register, April 11, 1988 





Department of 
Education 

34 CFR Part 99 

Family Educational Rights and Privacy; 
Final Regulations 
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Federal Register / Vol, 53, No. 69 / Monday, April 11, 1988 / Rules and Regulations 



DEPARTMENT OF EDUCATION 
34 CFR Part 99 

Family Educational Rights and Privacy 

AQENCv: Department of Education. 
ACTION: Final regulations. 

SUMMARY: The Secretary revises and 
renames the Department of Education 
regulations formerly titled the Privacy 
Rights of Parents and Students. These 
regulations are retitled Family 
Educational Rights and Privacy and 
eliminate some of the regulatory 
requirements placed on educational 
agencies and institutions. The 
regulations have also been rewritten for 
clarity. 

effective DATE: These regulations take 
effect either 45 days after publication in 
the Federal Register or later if the 
Congress takes certain adjournments. If 
you want to know the effective date of 
these regulations, call or write the 
Department of Education contact 
person, 

FOR FURTHER INFORMATION CONTACT: 

Ellen Campbell or Connie Moore. Family 
Policy and Regulations Office. Office of 
Management, U.S. Department of 
Education. 400 Maryland Avenue, SW. 
(Room 3021. Federal Office Building No. 
6), Washington. DC 20202. Telephone: 
(202) 732-2057. 

SUPPLEMENTARY INFORMATION: Under 
Executive Order 12291, the Department 
of Education regularly reviews its 
regulations to determine whether the 
Department can decrease burdens on 
the public and otherwise simplify and 
clarify existing regulations. As part of 
this process, the Department has 
reviewed the regulations implementing 
the Family Educational Rights and 
Privacy Act (FERPA). 

The FERPA regulations of the former 
Department of Health, Education, and 
Welfare (HEW) (45 CFR Part 99) were 
transferred to the Department of 
Education (ED) and recodified in Part 99 
of Title 34 of the Code of Federal 
Regulations on May 9. 1980 (45 FR 
30802). These regulations implement 
FERPA, which was enacted as section 
430 of the General Education Provisions 
Act (GEPA) (20 U.S.C. 1232g). 

The FERPA sets out requirements 
designed to afford parents and students 
privacy and other rights with respect to 
education records. The statute applies to 
educational agencies and institutions 
that receive funds under an applicable 
program administered by ED. For 
purposes of FERPA an applicable 
program is a program that was either 
formerly administered by the 



Commissioner of Education prior to the 
establishment of ED on May 4. 19B0 or 
any program that came into existence 
after ED was established, unless the law 
creating the new program has the effect 
of making FERPA inapplicable. 
Educational agencies and institutions to 
which FERPA applies must maintain 
education records consistent with the 
requirements of FERPA. In brief. FERPA 
requires those agencies or institutions to 
provide parents and eligible students 
access to records directly related to the 
students: to permit parents and eligible 
students to challenge those records on 
the grounds that they are inaccurate, 
misleading, or otherwise in violation of 
the student's privacy or other rights: to 
obtain the written consent of parents 
and eligible students before releasing 
personally identifiable information 
about the students contained in 
education records to other than 
organizations or individuals described 
in statutory exceptions: and to notify 
parents and eligible students of these 
rights. 

On )une 10. 1987. the Secretary 
published a notice of proposed 
rulemaking (NPRM) for this part in the 
Federal Register (52 FR 22250). The 
NPRM included a discussion of the 
numerous revisions and invited public 
comment. The revisions are intended to 
simplify and clarify the regulations and 
not to alter any interpretation under 
existing regulations. 

In response to the Secretary's 
invitation in the NPRM, educational 
associations, organizations, universities, 
and individuals submitted 20 letters, 
which contained a total of 113 
comments. More than half of the letters 
were from institutions of higher 
education and were transmitted through 
an organization representing the higher 
education community. An analysis of 
the comments and of the changes in the 
regulations since publication of the 
NPRM is published as an appendix to 
these final regulations. 

Executive Order 12606 

The Secretary has reviewed these 
regulations in accordance with 
Executive Order 12806. "The Family." 
The regulations was assessed in light of 
the criteria set forth in the Executive 
Order to determine whether they have 
any potential negative impact on the 
family. They were found to have no 
negative impact. In fact, the regulations 
will strengthen the autonomy, stability, 
and rights of the family unit. 

The criterion of the Order which is 
most applicable to these regulations 
asks: "Does this action strengthen or 
erode the authority and rights of parents 
in the education, nurture, and 



supervision of their children?" The 
stalute and the implementing regulations 
strengthen the rights of parents by 
reaffirming their basic right to have 
access to the education records of their 
children, their right to be assured of the 
privacy of their children’s records, and 
their right to challenge records believed 
to be inaccurate, misleading, or 
otherwise in violation of the studenfs 
privacy. 

Anolher criterion which is applicable 
to these regulations asks: “Does this 
action by government strengthen or 
erode the stability of the family and. 
particularly, the marital commitment?" 
Overall, these regulations are found to 
strengthen Ihe stability of the family. In 
particular, the FERPA provisions which 
afford parents the right to have access 
to and some control over the education 
records of their children serve to 
encourage parents to be involved in the 
education of their children. Furthermore, 
by affording both parents (whether 
custodial or non-custodial) the right to 
have access to the records, the 
regulations serve to encourage joint 
parental involvement in their children's 
education. 

Executive Order 12291 

These regulations have been reviewed 
in accordance with Executive Order 
12291. They are not classified as major 
because they do not meet the criteria for 
major regulations established in the 
order. 

Assessment of Educational Impact 

In the NPRM. the Secretary requested 
commenls on whether the proposed 
regulations would require transmission 
of information that is being gathered 
from any other agency or authority of 
the United States. 

Based on the response to the proposed 
rules and on its own review, the 
Department has determined that the 
regulations in this document do not 
require transmission of information that 
is being gathered by or is available from 
any other agency or authority of the 
United States. 

List of Subjects in 34 CFR Part 99 

Administrative practice and 
procedure, Education department. 

Family educational rights. Privacy. 
Parents. Reporting and recordkeeping 
requirements, Students. 

(Catalog of Federal Domestic Assistance 
number does not apply.) 
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Hated February 19. T9B8. 

Wiltiam ). Bennett. 

Secretory of Education. 

The Secretary revises Part 99 of Title 
34 of the Code of Federal Regulations to 
read as follows: 

PART 99— FAMILY EDUCATIONAL 
RIGHTS AND PRIVACY 

Subpart A— Gtntni 

See. 

99.1 To which educational agencies or 
institutions do these regulations apply? 

99.2 What is the purpose of these 
regulations? 

99.3 What definitions apply to these 
regulations? 

99.4 What are the rights of parents? 

99.5 What are the rights of eligible students? 

99.6 What information musl an educational 
agency's or institution's policy contain? 

99.7 What must an educational agency or 
institution include in its annual 
notification? 

Subpart B— What are the Right* of 
Inspection and Review of Education 
Records? 

99.10 What rights exist for a parent or 
eligible student to inspect and review 
education records? 

99.U May an educational agency or 
institution charge a fee for copies of 
education records? 

99.12 What limitations exist on the right to 
inspect and review records? 

Subpart C— What are the Procedures for 
Amending Education Records? 

99.20 How can a parent or eligible student 
request amendment of the Student’s 
education records? 



99.21 Under what conditions docs n parent 
or eligible student have the right to a 
hearing? 

99.22 What minimum requirements exist for 
the conduct of a hearing? 

Subpart D — May an Educational Agency or 

Institution DlaclOM Personalty Identifiable 
Information from Education Records? 

99.30 Under what conditions musl an 
educational agency or institution obtain 
prior consent to disclose information? 

99.31 Under what conditions is prior 
consent not required to disclose 
information? 

99.32 What recordkeeping requirements 
exist concerning requests and 
disclosures? 

99.33 What limitations apply to the 
redisclosure of information? 

99.34 What conditions apply to disclosure of 
information to other educational 
agencies or institutions? 

99.35 What conditions apply to disclosure of 
information for Federal or State program 
purposes? 

99.36 What conditions apply to disclosure of 
information in health and safety 
emergencies? 

99.37 What conditions apply to disclosing 
directory information? 

Subpart E— What ar* the Enforcement 

Procedure*? 

99.60 What functions has the Secretary 
delegated to the Office and to the 
Education Appeal Board? 

99.61 What responsibility does an 
educational agency or institution have 
concerning conflict with State or local 
laws? 

99.B2 What information must an educational 
agency or institution submit to the 
Office? 

99.63 Where are complaints filed? 

99.64 What is the complaint procedure? 



99.05 What is the content of the notice of 
complaint issued by the Office? 

99.66 What are the responsibilities of the 
Office in the enforcement process? 

99.67 How doe9 the Secretary enforce 
decisions? 

Authority; Sec. 438. I\jb. L. 90-247. Title IV, 
as amended. 68 Slat. 571-574 (20 U.S.C. 
123Zg). unless otherwise noted. 

Subpart A— General 

§ 99.1 To which educational agenete* or 
Institution* do the** regulation* apply? 

(a) Thi9 part applies to an educational 
agency or institution to which funds 
have been made available under any 
program administered by the Secretary 
of Education that — - 

(1) (i) Was transferred to the 
Department under the Department of 
Education Organization Act (DEOA): 
and 

(ii) Was administered by the 
Commissioner of Education on the day 
before the effective date of the DEOA: 
or 

(2) Was enacted after the effective 
date of the DEOA. unless the law 
enacting the new Federal program has 
the effect of making section 438 of the 
General Education Provisions Act 
inapplicable. 

(Authority: 20 U.S.C, 1230. 1232g, 34B7. 3507) 

(b) The following chart lists the 
funded programs to which Part 99 does 
not apply as of April 11, 1988: 



Name of program 



1. High School Equivalency Program and College Assistance Migrant Program 

i 

2. Programs administered by the Commissioner of the Rehabilitation Services | 

Administration, and the Director of rhe National institute on Disability and Rehabili- 1 
tation Research. j 

! 

3. Transition program for refugee children .. „j 



4. College Housing 

5. The following programs administered by the Assistant Secretary for Educational 
Research and Improvement: Educational Research Grant Program. Regional Edu« 
cationaf Laboratories Research and Development Centers, All other research or 
statistical activities funded under Section 405 or 406 of the General Education 
Provisions Act.. 



Authoring statute 



implementing 

regulations 



Section 418A of the Higher Education Act of 1965 as 
amended by ihe Education Amendments of 1980 
(Pub L 96-374) 20 US.C. 1070<J-2). 

The Rehabilitation Acl of 1973. as amended. (29 
U.S.C. 700. et $eq ). 



immigration and Nationality Act as amended by the 
Refugee Act of i960. Pub. L. 96-212 (0 li.S.C. 
1522(d)). 

Title IV of the Housing Act of 1950, 8S amended (12 
U.S.C. 1749, et soq.). 

Section 405 of the General Education Provisions Act 
(20 U.S.C. 1221 e). and section 406 of the General 
Education Provisions Act (20 U.S.C. 12Z1-T). 



Pan 206. 



Parts 350-359. 38 1. 
365. 366. 369-371, 
373-375. 378. 379. 
385-390. and 395. 
Part 538. 



Pari 614. 

Parts 700. 706-708. 



Note: The Secretary, as appropriate, updates the information in this char? and informs the public. 



(c) Thi& part does not apply to an 
educational agency or institution solely 
becauru students attending that agency 
or institution receive non-monetary 
benefits under a program referenced in 



paragraph (a) of this section, if no funds 
under that program are made available 
to the agency or institution. 

(d) The Secretary considers funds to 
be made available to an educational 
agency or institution of funds under one 



or more of the programs referenced in 
paragraph (a) of this section— 

[1) Are provided to the agency or 
institution by grant, cooperative 
agreement, contract, subgrant, or 
subcontract: or 
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(2) Are provided to students attending 
the agency or institution and the funds 
may be paid to the agency or institution 
by those students for educational 
purposes, such as under the Pell Grant 
Program and the Guaranteed Student 
Loan Program (Titles IV-A-1 and IV-B, 
respectively, of the Higher Education 
Act of 1965, as amended). 

(e) If an educational agency or 
institution receives funds under one or 
more of the programs covered by this 
section, the regulations in this part apply 
to the recipient as a whole, including 
each of its components (such as a 
department within a university). 
(Authority: 20 U.S.C. 1232g) 

5 99.2 What la th# purpose of theta 
regulation*? 

The purpose of this part is to set out 
requirements for the protection of 
privacy of parents and students under 
section 438 of the General Education 
Provisions Act. as amended. 

(Authority: 20 U.S.C. 1232g) 

(Note: 34 CFR 300.560-300.570 contain 
requirements regarding confidentiality of 
information relating to handicapped children 
who receive benefits under the Education of 
the Handicapped Act.) 

§ 99.3 What definitions apply to the** 
regulation*? 

The following definitions apply to this 
Dart: 

"Act*’ means the Family Educational 
Rights and Privacy Act of 1974. as 
amended, enacted as section 438 of the 
General Education Provisions Act. 
(Authority: 20 U.S.C. 123Zg) 

“Attendance** includes, but is not 
limited to- 
la) Attendance in person or by 
correspondence: and 

(b) The period during which a person 
is working under a work-study program. 

[Authority: 20 U.S.C. 1232g) 

“Directory information” means 
information contained in an education 
record of a student which would not 
generally be considered harmful or an 
invasion of privacy if disclosed. It 
includes, but is not limited to the 
student’s name, address, telephone 
listing, date and place of birth, major 
field of study, participation in officially 
recognized activities and sports, weight 
and height of members of athletic teams, 
dates of attendance, degrees and 
awards received, and the most recent 
previous educational agency or 
Institution attended. 

(Authority: 20 VS.C . 123Zg(a)(5)(A)) 

"Disclosure” means to permit access 
to or the release, transfer, or other 
communication of education records, or 



the personally indentifiable information 
contained in those records, to any party, 
by any means, including oral, written, or 
electronic means. 

(Authority: 20 U.S.C lZ32g(b)(l)) 

"Educational agency or institution" 
means any public or private agency or 
institution to which this part applies 
under 9 99.1 [a). 

(Authority: 20 U.S.C. 1232g(a)(3}) 

"Education records" (a) The term 
means those records that are — 

(1) Directly related to a student: and 

(2) Maintained by an educational 
agency or institution or by a party acting 
for the agency or institution. 

(b) The term does not include— 

(1) Records of instructional, 
supervisory, and administrative 
personnel and educational personnel 
ancillary to those persons that are kept 
in the sole possession of the maker of 
the record, and are not accessible or 
revealed to any other person except a 
temporary substitute for the maker of 
the record: 

(2) Records of a law enforcement unit 
of an educational agency or institution, 
but only if education records maintained 
by the agency or institution are not 
disclosed to the unit. and the law 
enforcement records are — 

(i) Maintained separately from 
education records; 

(ii) Maintained solely for law 
enforcement purposes: and 

(iii) Disclosed only to law 
enforcement officials of the same 
jurisdiction: 

(3) (i) Records relating to an individual 
who is employed by an educational 
agency or institution, that— 

(A) Are made and maintained in the 
normal course of business: 

(B) Relate exclusively to the 
individual in that individual’s capacity 
os an employee: and 

(C) Are not available for use for any 
other purpose. 

(ii) Records relating to an individual 
in attendance at the agency or 
institution who is employed as a result 
of his or her status as a student are 
education records and not excepted 
under paragraph (b)(3)(f) of this 
definition. 

(4) Records on a student who is 18 
years of age or older, or is attending an 
institution of postsecondary education, 
that are — 

(i) Made or maintained by a 
physician, psychiatrist, psychologist, or 
other recognised professional or 
paraprofessional acting in his or her 
professional capacity or assisting in a 
paraprofessional capacity*. 



(ii) Made, maintained, or used only in 
connection with treatment of the 
student; and 

(iii) Disclosed only to individuals 
providing the treatment. For the purpose 
of this definition, "treatment" does not 
include remedial educational activities 
or activities that are part of the program 
of instruction at the agency or 
institution; and 

(5) Records that only contain 
Information about an individual after he 
or she is no longer a student at that 
agency or institution. 

(Authority: 20 U.S.C. 1232g(a)(4)) 

"Eligible student" means a student 
who has reached 18 years of age or is 
attending an institution of 
postsecondary education. 

(Authority: 20 U.S.C 1232g(d]) 

"Institution of post9econdary 
education" means an institution that 
provides education to students beyond 
the secondary school level; “secondary 
school level" means the educational 
level (not beyond grade 12) at which 
secondary education is provided as 
determined under State law. 

(Authority: 20 U.S.C. 1232g(dJ) 

"Parent" means a parent of a student 
and includes a natural parent, a 
guardian, or an individual acting as a 
parent in the absence of a parent or a 
guardian. 

(Authority: 20 U.S.C. 1232g) 

"Party" means an individual, agency, 
institution, or organization. 

(Authority: 20 U.S.C. 1232g(b)(4)(A)) 

"Personally identifiable information” 
includes, but is not limited to — 

fa) The student's name; 

(b) The name of the student's parent 
or other family member; 

(c) The address of the student or 
student's family; 

(d) A personal identifier, such as the 
student's social security number or 
student number 

(e) A list of personal characteristics 
that would make the student's identity 
easily traceable; or 

(f) Other information that would make 
the student's identity easily traceable. 

(Authority: 20 U.S.C. 1232g) 

"Record" means any information 
recorded in any way, including, but not 
limited to* handwriting, print, tape, film, 
microfilm, and microfiche. 

(Authority: 20 U.S.C, 1232g) 

"Secretary” means the Secretary of 
the U.S. Department of Education or an 
official or employee of the Department 
of Education acting for the Secretary 
under a delegation of authority. 
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t Authority: 20 U.S.C. 1232g) 

"Student”, except as otherwise 
specifically provided in this part, means 
any individual who is or has been in 
attendance at an educational agency or 
institution and regarding whom the 
agency or institution maintains 
education records. 

(Authority: 20 U.S.C. 1Z32g(a){0)) 

§ 99.4 Whet art the rights of parents? 

An educational agency or institution 
shall give full rights under the Act to 
either parent, unless the agency or 
institution has been provided with 
evidence that there is a court order. 
State statute, or legally binding 
document relating to such matters as 
divorce, separation, or custody that 
specifically revokes these rights. 
(Authority: 20 U.S.C. 1232g) 

§ 99 £ What are the rights of eltgJbJs 
students? 

(a) When a student becomes an 
eligible student, the rights accorded to. 
and consent required of. parents under 
this part transfer from the parents to the 
student. 

(b) The Act and this part do not 
prevent educational agencies or 
institutions from giving students rights 
in addition to those given to parents. 

(c) If an individual is or has been in 
attendance at one component of an 
educational agency or institution, that 
attendance does not give the individual 
rights as a student in other components 
of the agency or institution to which the 
individual has applied for admission, 
but has never been in attendance. 

(Authority: 20 U.S.C. I232g(d)) 

§99.6 What Information mutt an 
educational agency's or instil utton’t policy 
contain? 

(a] Each educational agency or 
institution shall adopt a policy regarding 
how the agency or institution meets the 
requirements of the Act and of this part. 
The policy must include — 

(1) How the agency or institution 
informs parents and students of their 
rights, in accord with § 99.7; 

(2) How a parent or eligible student 
may inspect and review education 
records under § 99.10. including at 
least— 

(i) The procedure the parent or eligible 
student must follow to inspect and 
review the records; 

(ii) With an understanding that it may 
not deny access to education records, a 
description of the circumstances in 
which the agency or institution believes 
i( has a legitimate cause to deny a 
request for a copy of those records: 



(iii) A schedule of fees (if any) to be 
charged for copies; and 

(tv) A list of the types and locations of 
education records maintained by the 
agency or institution, and the titles and 
addresses of the officials responsible for 
the records; 

(3) A statement that personally 
identifiable information will not be 
released from an education record 
without the prior written consent of the 
parent or eligible student, except under 
one or more of the conditions described 
in § 99.31; 

(4) A statement indicating whether the 
educational agency or institution has a 
policy of disclosing personally 
identifiable information under 

§ 99.1(a)(1), and . if so. a specification of 
the criteria for determining which 
parties are school officials and what the 
agency or institution considers to be a 
legitimate educational interest; 

(5) A statement that a record of 
disclosures will be maintained as 
required by § 99.32, and that a parent or 
eligible student may inspect and review 
that record; 

(6) A specification of the types of 
personally identifiable information the 
agency or institution has designated as 
directory information under § 99,37; and 

(7) A statement that the agency or 
institution permits a parent or eligible 
student to request correction of the 
student’s education records under 

§ 99.20. to obtain a hearing under 
§ 99.21(a). and to add a statement to the 
record under § 99.21(b)(2). 

(b) The educational agency or 
institution shall state the policy in 
writing and make a copy of it available 
on request to a parent or eligible 
student. 

(Authority; 20 US.C. 1232g(e) and (0) 
(Approved by the Office of Management and 
Budget under control number 1860^-0508] 

§ 99.7 Whit mutt an educational agency 
or Institution Indudt In its manual 
notification? 

(a) Each educational agency or 
institution shall annually notify parents 
of students currently in attendance, and 
eligible students currently in attendance, 
at the agency or institution of their 
rights under the Act and this part. The 
notice must include a statement that the 
parent or eligible student has a right 
to* 

(1) Inspect and review the student’s 
education records; 

(2) Request the amendment of the 
student's education records to ensure 
that they are not inaccurate, misleading, 
or otherwise in violation of the student’s 
privacy or other rights; 

(3) Consent to disclosures of 
personally identifiable information 



O 

ERIC 



contained in the student's education 
records, except to the extent that the 
Act and the regulations in this part 
authorize disclosure without consent; 

(4) File with the U,S. Department of 
Education a complaint under § 99.64 
concerning alleged failures by the 
agency or institution to comply with the 
requirements of the act and this part; 
and 

(5) Obtain a copy of the policy 
adopted under § 99,6. 

(b) The notice provided under 
paragraph (a) of this section must also 
indicate the places where copies of the 
policy adopted under § 99.6 are located. 

(c) An educational agency or 
institution may provide this notice by 
any means that are reasonably likely to 
inform the parents and eligible students 
of their rights. 

(d) An agency or institution of 
elementary or secondary education shall 
effectively notify parents of students 
who have a primary or home language 
other than English. 

(Authority: 20 U.S.C. 1232g(e)) 

(Approved by the Office of Management and 
Budget under control number 1880-0508) 

Subpart B*What are the Rights of 
Inspection and Review of Education 
Records? 

§ 99.10 What rights exist for ■ parent or 
eligible student to Inspect and review 
education records? 

(a) Except as limited under § 99.12, 
each educational agency or institution 
shall permit a parent or eligible student 
to inspect and review the education 
records of the student. 

(b) The educational agency or 
institution shall comply with a request 
for access to records within a 
reasonable period of time, but in no case 
more than 45 days after it haB received 
the request. 

(c) The educational agency or 
institution shall respond to reasonable 
requests for explanations and 
interpretations of the records. 

(d) The educational agency or 
institution shall give the parent or 
eligible student a copy of the records if 
failure to do so would effectively 
prevent the parent or student from 
exercising the right to inspect and 
review the records. 

(e) The educational agency or 
institution shall not destroy any 
education records if there is an 
outstanding request to inspect and 
review the records under this section. 

(f) While on education agency or 
institution is not required to give an 
eligible student access to treatment 
records under paragraph (b)(4) of the 
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definition of ‘‘Education records" in 
5 99.3, the student may have those 
records reviewed by a physician or 
other appropriate professional of the 
student's choice. 

[Authority: 20 U.S.C. 1232g(a)(l)(A)) 

§ 99*1 1 May an aducatlonal agency or 
InaUtutton charge a lee for coplea of 
education records? 

(a) Unless the imposition of a fee 
effectively prevents a parent or eligible 
student from exercising the right to 
inspect and review the student^ 
education records, an educari';nal 
agency or institution may chaige a fee 
for a copy of an education record which 
is made for the parent or eligible 
student. 

(b) An educational agency or 
institution may not charge a fee to 
search for or to retrieve the education 
records of a student. 

(Authority: 20 U.S.C. 1232g(o)(l)) 

§ 99. 12 What limitations axlat on the right 
to Inspect and review records? 

(a) If the education records of a 
student contain information on more 
than one student, the parent or eligible 
student may inspect, review, or be 
informed of only the specific information 
about that student. 

(b) A postsecondary institution does 
not have to permit a student to inspect 
and review education records that are — 

(1) Financial records, including any 
information those records contain, of his 
or her parents; 

(2) Confidential letters and 
confidential statements of 
recommendation placed in (he education 
records of the student before January 1, 
1975, as long as the statements are U9ed 
only for the purposes for which they 
were specifically intended; and 

(3) Confidential letters and 
confidential statements of 
recommendation placed in the student's 
education records after January 1, 1975, 
if- 

(i) The student has waived his or her 
right to inspect and review those letters 
and statements; and 

(ii) Those letters and statements are 
related to the student’s — 

(A) Admission to an educational 
institution: 

(B) Application for employment; or 

(C) Receipt of an honor or honorary 
recognition. 

(c)(1) A waiver under paragraph 
(b)(3)(i) of this section is valid only if— 

(i) The educational agency or 
institution does not require the waiver 
as a condition for admission to or 
receipt of a service or benefit from the 
agency or institution; and 



(ii) The waiver is made in writing and 
signed by the student, regardless of age, 

(2) If a student has waived his or her 
rights under paragraph (b)(3)(i) of this 
section, the educational institution 
shall — 

(i) Give the student, on request, the 
names of the individuals who provided 
the letters and statements of 
recommendation; and 

(ii) Use the letters and statements of 
recommendation only for the purpose 
for which they were intended. 

(3) (i) A waiver under paragraph 

(b) (3)(i) of this section may be revoked 
with respect to any actions occurring 
after the revocation. 

(ii) A revocation under paragraph 

(c) (3)(i) of this section must be in 
writing. 

(Authority: 20 U.S.C. 1232g(a)(l) (A) and (B)) 

Subpart C— What are the Procedures 
for Amending Education Records? 

§ 99.20 How can a parent or eligible 
student request amendment of the 
student’s education records? 

(a) IF a parent or eligible student 
believes the education records relating 
to the student contain information that 
is inaccurate, misleading, or in violation 
of the student’s rights of privacy or other 
rights, he or she may ask the 
educational agency or institution to 
amend the record. 

(b) The education agency or 
institution shall decide whether to 
amend the record as requested within a 
reasonable time after the agency or 
institution receives the request, 

(c) if the educational agency or 
institution decides not to amend the 
record as requested, it shall inform the 
parent or eligible student of its decision 
and of his or her right to a hearing under 
§ 99.21. 

(Authority: 20 U.S.C. 1232g(B)(2)) 

§99.21 Under whst conditions doe* a 
parent or eligible etudant have the right to 
a hearing? 

(a) An educational agency or 
institution shall give a parent or eligible 
student, on request, an opportunity for a 
hearing to challenge the content of the 
student's education records on the 
grounds that the information contained 
in the education records is inaccurate, 
misietoulr.g, cv in violation of the privacy 
or other rights of the student. 

(b) (1) If, as a result of the hearing, the 
educational agency or institution 
decides that the information is 
inaccurate, misleading, or otherwise in 
violation of the privacy or other rights of 
the student, it shall — 

(i) Amend the record accordingly; and 



(ii) Inform the parent or eligible 
student of the amendment in writing, 

(2) If, as a result of the hearing, the 
educational agency or institution 
decides that the information in the 
education record is not inaccurate* 
misleading, or otherwise in violation of 
the privacy or other rights of the student, 
it shall inform the parent or eligible 
student of the right to place a statement 
in the record commenting on the 
contested information in the record or 
stating why he or she disagrees with the 
decision of the agency or institution, or 
both. 

(c) If an educational agency or 
institution places a statement in the 
education records of a student under 
paragraph (b)(2) of this section, the 
agency or institution shall — 

(1) Maintain the statement with the 
contested part of the record for as long 
as the record is maintained: and 

(2) Disclose the statement whenever it 
discloses the portion of the record to 
which the statement relates. 

(Authority: 20 U.S.C. 1232g[a)(2)) 

§ 99.22 What minimum requirement* exist 
for the conduct of • hearing? 

The hearing required by § 99.21 mU9t 
meet, at a minimum, the following 
requirements: 

(a) The educational agency or 
institution shall hold the hearing within 
a reasonable time after it has received 
the request for the hearing from the 
parent or eligible student. 

(b) The educational agency or 
institution shall give the parent or 
eligible student notice of the date, time, 
and place, reasonably in advance of the 
hearing. 

(c) The hearing may be conducted by 
any individual, including an official of 
the educational agency or institution, 
who does not have a direct interest in 
the outcome of the hearing. 

(d) The educational agency or 
institution shall give the parent or 
eligible student a full and fair 
opportunity to present evidence relevant 
to the issues raised under § 99.21. The 
parent or eligible student may, at their 
own expense, be assisted or represented 
by one or more individuals of his or her 
own choice, including an attorney, 

(e) The educational agency or 
institution shall make its decision in 
writing within a reasonable period of 
time after the hearing. 

(f) The decision must be based solely 
on the evidence presented at the 
hearing, and must include a summary of 
the evidence and the reasons for the 
decision. 

(Authority: 20 U.S.C. 1232g(a)(2)} 
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Subpart D-May an Educational 
Agency or Institution Disclose 
Personally Identifiable Information 
From Education Records? 

5SS.30 Under what conditions must an 
educational agency or Institution obtain 
prior consent to disclose Information? 

(a) Except as provided in § 99.31. an 
educational agency or institution shall 
obtain a signed and dated written 
consent of a parent or an eligible 
student before it discloses pesonally 
identifiable information from the 
student’s education records. 

(b) The written consent must— 

(1) Specify the records that may be 
disclosed; 

(2) State the purpose of the disclosure; 
and 

(3) Identify the party or class of 
parties to whom the disclosure may be 
made. 

(c) When a disclosure is made under 
paragraph (a) of this section— 

(1) If a parent or eligible student so 
requests, the educational agency or 
institution shall provide him or her with 
a copy of the records disclosed; and 

(2) IF the parent of a student who is 
not an eligible student so requests, the 
agency or institution shall provided the 
student with a copy of the records 
disclosed. 

(Authority: 20 U.S.C. 1232g (b)(1) and 
(b)(2)(A)) 

§ 99.31 Under what conditio It prior 
consent not required to disclose 
information? 

(a) An educational agency or 
institution may disclose personally 
identifiable information from an 
education record of a student without 
the consent required by § 99 30 if the 
disclosure meets one or more of the 
following conditions: 

(1) The disclosure is to other school 
officials, including teachers, within the 
agency or institution whom the agency 
or institution ha9 determined to have 
legitimate educational interests. 

(2) The disclosure is, subject to the 
requirements of 5 99.34, to officials of 
another school, school system, or 
institution of poatsecondary education 
where the student seeks or intends to 
enroll. 

(3) The disclosure is, subject to the 
requirements of $ 99.35, to authorize 
representatives of— 

(i) The Comptroller General of the 
United States; 

(li) The Secretary; or 

(iii) State and local educational 
authorities, 

(4) (i) The disclosure is in connection 
with financial aid for which the student 
has applied or which the student has 



received, if the information is necessary 
. for such purposes as to— 

(A) Determine eligibility for the aid; 

(B) Determine the amount of the aid; 

(C) Determine the conditions for the 
aid; or 

(D) Enforce the terms and conditions 
of the aid, 

(ii) As used in paragraph (a){4)(i) of 
this section, "financial aid" means a 
payment of funds provided to an 
individual (or a payment in kind of 
tangible or intangible property to the 
individual) that is conditioned on the 
individual's attendance at an 
educational agency or institution, 
(Authority: 20 U.S.C. 1232g(b)(1)(D)) 

(5) (i) The disclosure is to State and 
local officials or authorities, if a State 
statute adopted before November 19, 
1974, specifically requires disclosures to 
those officials and authorities. 

(ii) Paragraph (a](5)(i) of this section 
does not prevent a State from further 
limiting the number or type or State or 
local officials to whom disclosures may 
be made under that paragraph. 

(6) (ij The disclosure is to 
organizations conducting studies for, or 
on behalf of, educational agencies or 
institutions to— 

(A) Develop, validate, or administer 
predictive tests; 

(B) Administer student aid programs: 
or 

(C) Improve instruction. 

(ii) The agency or institution may 
disclose information under paragraph 
(a)(6)(i) of this section only if— 

(A) The study is conducted in a 
manner that does not permit personal 
identification of parents and students by 
individuals other than representatives of 
the organization; and 

(B) The information is destroyed when 
no longer needed for the purposes for 
which the study was conducted. 

(iii) For the purposes of paragraph 
(a)(8) of this section, the term 
"organization” includes, but is not 
limited to, Federal, State, and local 
agencies, and independent 
organizations. 

(7) The disclosure is to accrediting 
organizations to carry out their 
accrediting functions, 

(8) The disclosure is to parents of a 
dependent student, as defined in section 
152 of the Internal Revenue Code of 
1954. 

(9) (i) The disclosure is to comply with 
a judicial order or lawfully issued 
subpoena. 

(ii) The educational agency or 
institution may disclose information 
under paragraph (a)(9)(i) of this section 
only if the agency or institution makes a 
reasonable effort to notify the parent or 



eligible student of the order or subpoena 
in advance of compliance. 

(10) The disclosure is in connection 
with a health or safety emergency, 
under the conditions described in 

l 99,36, 

(11) The disclosure is information the 
educational agency or institution has 
designated as "directory information 
under the conditions described in 

5 99.37. 

(12) The disclosure is to the parent of 
a student who is not an eligible student 
or to the student. 

(b) This section does not forbid or 
require an educational agency or 
institution to disclose personally 
identifiable information from the 
education records of a student to any 
parties under paragraphs (a) (1} through 
(11) of this section. 

(Authority: 20 U.S.C. 1232g (a)(5)(A). (b)(1) 
and (b)(2)(B)) 

§ 99.32 What recordkeeping requirements 
exist concerning rtquaata and dlsckMurta? 

(a) (1) An educational agency or 
institution shall maintain a record of 
each request for access to and each 
disclosure of personally identifiable 
information from the education records 
of each student. 

(2) The agency or institution shall 
maintain the record with the education 
records of the student as long as the 
records are maintained. 

(3) For each request or disclosure the 
record must include — 

(i) The parties who have requested or 
received personally identifiable 
information from the education records; 
and 

(ii) The legitimate interests the parties 
had in requesting or obtaining the 
information. 

(b) If an educational agency or 
institution discloses personally 
identifiable information from an 
education record with the understanding 
authorized under { 99.33(b), the record 
of the disclosure required under this 
section must include — 

(1) The names of the additional 
parties to which the receiving party may 
disclose the information on behalf of the 
educational agency or institution; and 

(2) The legitimate interests under 
$ 99.31 which each of the additional 
parties has in requesting or obtaining 
the information. 

(c) The following parties may inspect 
the record relating to each student: 

(1) The parent or eligible student. 

(2) The school official or his or her 
assistants who are responsible for the 
custody of the records. 

(3) Those parties authorized in 

S 99.31(a) (1) and (3) for the purposes of 
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auditing the recordkeeping procedures 
of the educational agency or institution. 

(d) Paragarph (a) of this section does 
not apply if the request was from, or the 
disclosure was to — 

(1) The parent or eligible student: 

(2) A scnool official under 
§ 99.31(a)(1); 

(3) A party with written consent from 
the parent or eligible student; or 

(4) A party seeking directory 
information. 

(Authority: 20 U.S.C. 1232g(b)(4)(A)) 
(Approved by the Office of Management and 
Budget under control number 1880-0508) 

§99.33 What ttmttitions apply to the 
redlsdoaure of Information? 

(a) (1) An educational agency or 
institution may disclose personally 
identifiable information from an 
education record only on the condition 
that the party to whom the information 
is disclosed will not disclose the 
information to any other party without 
the prior consent of the parent or 
eligible student. 

(2) The officers, employees, and 
agents of a party that receives 
information under paragraph (a)(1) of 
this section may use the information, but 
only for the purposes for which the 
disclosure was made. 

(b) Paragraph (a) of this section does 
not prevent an educational agency or 
institution from disclosing personally 
identifiable information with the 
understanding that the party receiving 
the information may make further 
disclosures of the information on behalf 
of the educational agency or institution 
if— 

(1) The disclosures meet the 
requirements of § 99.31; and 

(2) The educational agency or 
institution has complied with the 
requirements of § 99.32(b). 

(c) Paragraph (a) of this section does 
not apply to disclosures of directory 
information under § 99.31(a](ll] or to 
disclosures to a parent or student under 
§ 99.3t(a)(12). 

(d) Except for disclosures under 

§ 99.31(a) (11) and (12). an educational 
agency or institution shall inform a 
party to whom disclosure is made of the 
requirements of this section. 

(Authority; 20 U.S.C. 1232g(b)(4)(8)) 

§9944 What condition* apply to 
dtactotura of information to other 
educational agaocfet or InatHutiona? 

(a) An educational agency or 
institution that discloses an education 
record under ( 99.31(a)(2) shall— 

(1) Make a reasonable attempt to 
notify the parent or eligible student at 
the last known address of the parent or 
eligible student, unless— 



(1) The disclosure is initiated by the 
parent or eligible student; or 

(ii) The policy of the agency or 
institution under § 99.0 includes a notice 
that the agency or institution forwards 
education records to other agencies or 
institutions that have requested the 
records and in which the student seeks 
or intends to enroll; 

(2) Give the parent or eligible student, 
upon request, a copy of the record that 
was disclosed; and 

(3) Give the parent or eligible student, 
upon request, an opportunity for a 
hearing under Subpart C. 

(b) An educational agency or 
institution may disclose an education 
record of a student in attendance to 
another educational agency or 
institution if— 

(1) The student is enrolled in or 
receives services from the other agency 
or institution; and 

(2) The disclosure meets the 
requirements of paragraph (a) of this 
section. 

(Authority: 20 U.S.C. 1232g(b)(l)(B)) 

§9945 What condMona apply to 
dtedoauro of information for Federal or 
Stato program purpoaaa? 

[a] The officials listed in § 99.31(a)(3) 
may have access to education records in 
connection with an audit or evaluation 
of Federal or State supported education 
programs, or for the enforcement of or 
compliance with Federal legal 
requirements which relate to those 
programs. 

[b] Information that is collected under 
paragraph (a) of this section must— 

(1) Be protected in a manner that does 
not permit personal identification of 
individuals by anyone except the 
officials referred to in paragraph (a) of 
this section; and 

(2) Be destroyed when no longer 
needed for the purposes listed in 
paragraph (a) of this section. 

[c] Paragraph [b] of this section does 
not apply if— 

(1) The parent or eligible student has 
given written consent for the disclosure 
under § 99.30; or 

(2) The collection of personally 
identifiable information is specifically 
authorized by Federal law. 

[Authority: 20 U.S.C. 1232g(b)(3)) 

§99.30 What condition* tpply to 
disclosure of information In haatth and 
aafaty emargendaa? 

(a) An educational agency or 
institution may disclose personally 
identifiable information from an 
education record to appropriate parties 
In connection with an emergency if 
knowledge of the information Is 



necessary to protect the health of safety 
or the student or other individuals. 

(b) Paragraph (a) of this section shall 
be strictly construed. 

(Authority: 20 U.S.C 1232g(b)(J)(l)) 

§99.3? What conditions apply to 
dladoai tng directory information? 

(a) An educational agency or 
institution may disclose directory 
information if it has given public notice 
to parents of students in attendance and 
eligible students in attendance at the 
agency or institution of— 

(1) The types of personally 
identifiable information that the agency 
or institution has designated as 
directory information; 

(2) A parent's or eligible student's 
right to refuse to let the agency or 
institution designate any or all of those 
types of information about the student 
as directory information; and 

(3) The period of time within which a 
parent or eligible student has to notify 
the agency or institution in writing that 
he or she does not want any or all of 
those types of information about the 
student designated as directory 
information. 

(b) An educational agency or 
institution may disclose directory 
information about former students 
without meeting the conditions in 
paragraph (a) of this section. 

(Authority: 20 U.S.C. I232g(a)(5) (A) and (B)) 

Subpart E— What are tha Enforcement 
Procedures? 

§99.60 What function* has the Secretary 
delegated to the Office and to the 
Education Apptal Board? 

(a) For the purposes of this subpart, 
"Office" means the Family Policy and 
Regulations Office, U.S. Department of 
Education. 

(b) The Secretary designates the 
Office to- 
ft) Investigate, process, and review 

complaints and violations under the Act 
and this part; and 

(2) Provide technical assistance to 
ensure compliance with the Act and this 
part. 

(c) The Secretary designates the 
Education Appeal Board to act as the 
Review Boaitl required under the Act. 
(Authority: 20 U.S.C. 1232g (I) and (g), 1234) 

§99.91 What reeponatWIIty dot* an 
educational agency or Institution havo 
concerning conflict with State or local 
laws? 

[f an educational agency or institution 
determines that it cannot comply with 
the Act or this part due to a conflict with 
State or local law, it shall notify the 
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Office within 45 day9, giving the text 
and citation of the conflicting law, 
(Authority: 20 U.S.C. 1232g(f)) 

§ 99.02 What information mutt an 
educational agency or institution submit to 
tha Office? 

The Office may require an educational 
agency or institution to submit reports 
containing information necessary to 
resolve complaints under the Act and 
the regulations in this part. 

(Authority: 20 U.S.C. 1232g (f) and (gj) 

§ 99.93 Where are complaints filed? 

A person may file a written complaint 
with the Office regarding an alleged 
violation under the Act and this part. 

The Office’s address is: Family Policy 
and Regulations Office, U.S. Department 
of Education, Washington, DC 20202. 
(Authority: 20 U.S.C. 1232g(g)) 

5 99.64 What le the complaint procedure? 

(a) A complaint filed under 5 99.63 
must contain specific allegations of fact 
giving reasonable cause to believe that a 
violation of the Act or this part has 
occurred. 

(b) The Office investigates each 
timely complaint to determine whether 
the educational agency or institution has 
failed to comply with the provisions of 
the Act or this part. 

(Authority: 20 U.S.C. 1232g[f]) 

599.65 What la tha contant of tha notlca 
of complaint tssuad by tha Ofnca? 

(a) If the Office receives a complaint, 
it notifies the complainant and the 
educational agency or institution against 
which the violation has been alleged, in 
writing, that the complaint has been 
received, 

(b) The notice to the agency or 
institution under paragraph (a) of this 
section— 

(1) Includes the substance of the 
alleged violation; and 

(2) Informs the agency or institution 
that the Office will investigate the 
complaint and that the educational 
agency or institution may submit a 
written response to the complaint. 
(Authority: 20 U.S.C. 123 2gfg)} 

599.66 What art the mpontlbHItta of 
tha Office In tha anforcamant proem? 

(a) The Office reviews the complaint 
and response and may permit the 
parties to submit further written or oral 
arguments or information. 

(b) Following its investigation, the 
Office provides to the complainant and 
the educational agency or institution 
written notice of its findings and the 
basis for its findings. 

(c) If the Office finds that the 
educational agency or institution has not 



complied with the Act or this part, the 
notice under paragraph (b] of this 
section — 

(1) Includes a statement of the specific 
steps that the agency or institution must 
take to comply; and 

(2) Provides a reasonable period of 
time, given all of the circumstances of 
the ca9e, during which the educational 
agency or institution may comply 
voluntarily. 

(Authority: 20 U.S.C. 1232g(f)) 

5 99.67 How dots the Secretary enforce 
decisions? 

(a) If the eductional agency or 
institution does not comply during the 
period of time set under 5 99.66(c). the 
Secretary may take an action authorized 
under 34 CFR Part 78. including— 

(1) Issuing a notice of intent to 
terminate funds under 34 CFR 70.21; 

(2) Issuing a notice to withhold funds 
under 34 CFR 70.21, 200.94(b) or 
290.45(b). depending upon the applicable 
program under which the notice is 
issued; or 

(3) Issuing a notice to cease and desist 
under 34 CFR 78.31, 200.94(c) or 
298.45(c), depending upon the program 
under which the notice is issued. 

(b) If, after an investigation under 
5 99.66, the Secretary finds that an 
educational agency or institution has 
complied voluntarily with the Act or this 
part, the Secretary provides the 
complianant and the agency or 
institution written notice of the decision 
and the basis for the decision. 

(Note: 34 CFR Part 78 contains the 
regulations of the Education Appeal Board.) 

(Authority: 20 U.S.C. 1232 r(r)] 
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DEPARTMENT OF EDUCATION 

34 CFR Part 99 
RIN 1880-AA57 

Family Educational Rights and Privacy 

AGENCY: Department of Education. 
ACTION: Final regulations. 

SUMMARY: The Secretary amends the 
regulations implementing the Family 
Educational Rights and Privacy Act 
(FERPA), which is section 438 of the 
General Education Provisions Act. 

These amendments are needed to 
implement a provision of the Higher 
Education Amendments of 1992, which 
modified the conditions under which 
records of an institution’s law 
enforcement unit are excluded from the 
definition of “education records.” As 
amended, FERPA excludes from the 
definition of “education records,” and 
thereby from the restrictions and rights 
of access under FERPA, records that are 
maintained by a law enforcement unit of 
an educational agency or institution that 
were created by that unit for the 
purpose of law enforcement. 

EFFECTIVE DATE: These regulations take 
effect either 45 days after publication in 
the Federal Register or later if the 
Congress takes certain adjournments. If 
you want to know the effective date of 
these regulations, call or write the 
Department of Education contact 
person. A document announcing the 
effective date will be published in the 
Federal Register. 

FOR FURTHER INFORMATION CONTACT: 

Ellen Campbell, Family Policy 
Compliance Office, Office of 
Management, U.S. Department of 
Education, 600 Independence Avenue, 
S.W., Washington, D.C. 20202-4605. 
Telephone (202) 260-3887. Individuals 
who use a telecommunications device 
for the deaf (TDD) may call the Federal 
Information Party Relay Service (FIRS) 
at 1-800-877-8339 between 8 a.m. and 
8 p.m., Eastern time, Monday through 
Friday. 

Postsecondary institutions that have 
questions relative to any of the 
requirements in the Higher Education 
Act regarding disclosure of information 
about campus safety policies and 
procedures and campus crime statistics 
should contact Paula M. Husselmann or 
Kimberly L. Goto at (202) 708-7888. 
SUPPLEMENTARY INFORMATION: On August 
11 and December 14, 1993, the Secretary 
published two notices of proposed 
rulemaking (NPRMs) for 34 CFR part 99 
in the Federal Register (58 FR 42836- 
42837 and 58 FR 65298-65300, 
respectively). The second NPRM did not 



change the proposed regulations but 
merely asked for additional public 
comment based on the response to the 
first NPRM. 

The proposed regulations define for 
the first time both “law enforcement 
unit” and “disciplinary action or 
proceeding.” In contrast to law 
enforcement unit records, the 
Department has been legally constrained 
to treat the records of a disciplinary 
action or proceeding as “education 
records” under FERPA (20 U.S.C. 

1232g), that is, protected against non- 
consensual disclosure except in 
statutorily specified circumstances and 
subject to inspection and review by 
parents and eligible students. The 
Secretary proposed the definition of 
“disciplinary action or proceeding” to 
help institutions distinguish 
disciplinary records from law 
enforcement unit records, which are 
excluded by statute from the definition 
of “education records” in the 
circumstances specified. 

Many of the public comments 
received on the first NPRM challenged 
the Department’s position on this issue 
and expressed the view that records of 
institutional disciplinary proceedings 
taken against students accused of 
criminal and other non-academic 
misconduct should not be considered 
“education records” under FERPA and 
should be available to the public even 
without the parent’s or student’s 
consent. This issue, which has been the 
subject of recent media attention, took 
precedence over the issue of law 
enforcement unit records in the 
comment process. The Secretary sought 
additional public comment on the issue 
because it raised important and 
sensitive concerns about campus crime 
as well as students’ need for privacy and 
access to records in the educational 
process. 

The Secretary remains legally 
constrained to conclude that records of 
an institution’s disciplinary action or 
proceeding are “education records” 
under FERPA, not law enforcement unit 
records, and that excluding these 
records from the definition of 
“education records” can be 
accomplished only through a statutory 
amendment of FERPA by Congress, In 
support of this view, Congress enacted 
in 1990 a new statutory provision 
permitting non-consensual disclosure of 
only the results of disciplinary 
proceedings conducted by 
postsecondary institutions; the 
disclosure is limited to the alleged 
victim of a crime of violence as defined 
in the United States Code and not to the 
public generally. However, the Secretary 
also recognizes that the issue of full 



public access to disciplinary hearing 
records concerning criminal and other 
non-academic misconduct is an 
important part of the ongoing debate 
concerning safety on college campuses 
and believes that, given the competing 
interests involved, these issues need to r 
be aired and argued in the legislative 
arena. Therefore, the Secretary has 
notified Congress of the need to address 
this issue and has offered to work with 
Congress in drafting an appropriate 
FERPA amendment that identifies and 
balances these interests at various 
education levels. 

Analysis of Comments and Changes 

In response to the Secretary’s 
invitation in the NPRMs to comment, 
approximately 150 parties submitted 
comments on the proposed regulations. 

An analysis of the comments and 
changes in the regulations since 
publication of the NPRMs follows. 
Substantive issues are discussed under 
the section of the regulations to which 
they pertain. 

Section 99.3 What definitions apply to 
these regulations? Definition of 
“Disciplinary action or proceeding .” 

Comments: A majority of commenters 
approved of the Secretary’s effort to 
effectively clarify the distinction 
between disciplinary records and law 
enforcement unit records. Those 
commenters stated that to allow the 
release of student disciplinary records 
to the public without consent would 
compromise what they believe to be the 
fundamental educational mission of the 
campus judicial process. Several 
commenters also stated that if FERPA 
were amended to allow such 
disclosures, institutions would have to 
amend their disciplinary procedures to 
incorporate greater due process 
protections. These commenters, mostly 
officials at postsecondary institutions, 
argued that campus judicial systems 
have been effective in responding to 
violations of institutional policy 
because of the privacy protections 
afforded to students by FERPA. 

A substantial minority, however, 
disagreed and stated that disciplinary 
records relating to criminal and other 
non-academic conduct should not be 
treated as “education records.” They 
argued that postsecondary institutions 
have used FERPA to evade efforts by the 
public to gain access to information 
about crime on campuses. These 
commenters questioned the statement in 
the NPRMs that the Department has 
always considered records relating to an 
institution’s internal proceedings that 
deal with violations of its own rules and 
standards of student conduct as 
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“education records” under FERPA. The 
commenters believe that the 
Department’s position in this matter 
represents an effort to circumvent the 
recent State court ruling, Red & Black 
Publishing Co. v. Board of Regents, 427 
S.E.2d 257, 261 (Ga. 1993), which 
considered records of a disciplinary 
action against a student fraternity 
outside the definition of “education 
records” and, thus, outside the privacy 
protections of FERPA. Several 
commenters also requested that the 
proposed definition of “disciplinary 
action or proceeding” be changed to 
include only violations of academically- 
related rules and that disciplinary 
action taken against a student for 
criminal acts be excluded. 

Discussion : The Secretary has 
carefully analyzed the statutory and 
regulatory authority to address these 
concerns. Based on the broad definition 
of “education records,” which includes 
those records, files, documents, and 
other materials that contain information 
directly related to a student, except 
those that are specifically excluded by 
statute, all disciplinary records, 
including those related to non-academic 
or criminal misconduct by students, are 
“education records” subject to FERPA. 

It is noted that Red & Black Publishing 
Co. v. Board of Regents concerned 
records of a student “organization 
court,” which disciplined a student 
organization (fraternity) for a rules 
violation, and did not concern 
disciplinary action against an individual 
student. More recently, another State 
court ruled that FERPA prevented a 
university from releasing to the media 
personally identifiable information from 
student disciplinary records without 
consent. Shreveport Professional 
Chapter of the Society of Professional 
Journalists v. Louisiana State University 
in Shreveport, Case No. 393,332, First 
Judicial District Court, Caddo Parish, 

LA, (March 4, 1994). Although the 
Secretary is equally concerned with the 
problem of crime on campus, it is clear 
that only Congress has the authority to 
change the statutory provisions of 
FERPA to permit disclosure of 
disciplinary records without prior 
consent. 

Nevertheless, because crime on our 
Nation’s college campuses has escalated 
since 1974 when FERPA was enacted, 
the Secretary has notified Congress of 
the need to address this important issue. 
The Congress may find that public 
access to disciplinary records 
concerning criminal and other non- 
academic misconduct is an appropriate 
response to the problem of maintaining 
safe college campuses, and the Secretary 
has offered to work with Congress in 



writing an appropriate amendment to 
FERPA. 

The Secretary received very few 
comments from State and local 
educational officials on how the 
proposed definition of “disciplinary 
action or proceeding” might affect 
elementary and secondary schools. 
Issues regarding the privacy of minor 
students and their families on the 
elementary and secondary level may 
require different treatment than those of 
postsecondary students. At this time, 
FERPA is consistent with those State 
laws that protect information regarding 
juvenile offenders. 

Change: None. 

Comments: Even among those 
commenters who approved of the 
proposed definition of “disciplinary 
action or proceeding,” several 
postsecondary officials noted that it is 
important that institutions be able to tell 
victims the outcome of a disciplinary 
proceeding regarding their assailant. 

Discussion: Section 99.31(a)(13) of the 
FERPA regulations, which implements 
20 U.S.C. 1232g(b)(6) of the statute, 
permits postsecondary institutions to 
disclose to an alleged victim of a crime 
of violence, as defined in the United 
States Code, the results of any 
disciplinary proceeding conducted by 
the institution against the alleged 
perpetrator. As noted earlier, this 
specific statutory exception to the prior 
written consent rule, enacted in 1990 as 
part of the Student Right-to-Know and 
Campus Security Act, demonstrates 
Congress’ view that disciplinary records 
are education records under FERPA. 
Additionally, 34 CFR 668.47(a)(12)(vi) 
(Student Assistance General Provisions) 
provides that in cases of an alleged sex 
offense both the accuser and the 
accused shall be informed of the 
outcome of any institutional 
disciplinary proceeding at the 
postsecondary level. On the elementary 
and secondary level, Congress has made 
no changes to FERPA that would allow 
a school official to disclose information 
relating to a disciplinary action without 
the prior consent of that student’s 
parents, to an alleged victim or the 
alleged victim’s parents. The Secretary 
has no authority to change these 
statutory provisions to provide for 
disclosure of information from 
disciplinary records other than in the 
circumstances identified. 

Change: None. 

Comments: Some commenters noted 
that conduct that would constitute a 
criminal violation should not be kept 
confidential as part of a campus 
disciplinary proceeding and that 
disciplinary hearings should be open to 
the public. In contrast, a number of 



school officials stated that to allow 
disciplinary hearings to be open to the 
public would substitute those processes 
for criminal proceedings, which would 
negate a long-standing separation of an 
on-campus disciplinary system from the 
criminal justice system. 

Discussion: FERPA does not prevent 
an institution from opening disciplinary 
proceedings to the public. Rather, 

FERPA prevents the non-consensual 
disclosure of education records or 
personally identifiable information from 
“education records,” unless the 
disclosure meets one or more of the 
statutory conditions for non-consensual 
disclosure. Schools routinely restrict 
access to disciplinary proceedings to 
those school officials with a “legitimate 
educational interest,” which is the first 
condition for non-consensual disclosure 
under section (b)(1) of the statute, 
because information from “education 
records” is frequently disclosed in a 
disciplinary hearing. 

As discussed above, the Secretary has 
advised and offered to work with 
Congress toward an appropriate solution 
to the concern about campus safety 
issues in relation to FERPA. 

Change: None. 

Comments: Several commenters 
expressed concern that, as parents, they 
would want to know how many sexual 
assaults had been reported at the 
schools to which their children had 
applied or at which their children were 
attending. These commenters believed 
that disciplinary records related to 
criminal conduct should not be 
considered “education records.” 

Discussion: Parents and students at 
the postsecondary level may currently 
obtain information about the type and 
the amount of crime on college 
campuses under 34 CFR 668.47(a)(6) 
(Student Assistance General Provisions), 
which implements the Student Right-to- 
Know and Campus Security Act. These 
provisions require postsecondary 
institutions to report annually statistics 
concerning the occurrence on campus of 
certain crimes, including sexual 
assaults, that have been reported to local 
police agencies and to any official of the 
institution who has significant 
responsibility for student and campus 
activities. The Secretary is enforcing 
these requirements fully and believes 
that they will make students — and their 
parents — aware of the nature and the 
amount of crime on any college campus 
they may attend or which they are 
considering attending. 

Change: None. 

Comments: One commenter noted 
that the definition of “disciplinary 
action or proceeding” does not 
specifically state that disciplinary 
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records are education records, thus 
leaving open to interpretation whether 
they are “education records” subject to 
FERPA. Another commenter suggested 
that the definition be changed to 
include all appeals of the initial 
adjudication or imposition of sanctions. 

Discussion: Under FERPA, the 
statutory definition of “education 
records” is all inclusive, covering 
“those records, files, documents, and 
other materials, which (i) contain 
information directly related to a student; 
and (ii) are maintained by an 
educational agency or institution, or by 
a person acting for such agency or 
institution.” 20 U.S.C. 1232g(a)(4)(A). 
The only types of records specifically 
identified in FERPA are those that are 
specifically excluded from the 
definition of “education records,” such 
as law enforcement unit records. 20 
U.S.C. 1232g(a)(4)(B). FERPA does not 
list, identify, or single out any particular 
type of materials or documents as 
“education records.” Consequently, the 
regulations explain that records of a law 
enforcement unit do not include or 
mean disciplinary records. That is, they 
are not excluded from the definition of 
“education records” under FERPA. 

Change: None. 

Section 99.8 What provisions apply to 
records of a law enforcement unit? 

Definition of “law enforcement unit”. 

Comments: One commenter, a State 
assistant attorney general, interpreted 
the proposed rules to mean that if a 
school principal or dean maintained a 
record on a student in a discipline file 
it would be an “education record” 
protected by FERPA, but that the same 
record maintained by the institution’s 
law enforcement unit would not be 
protected by FERPA and could be 
disclosed to an outside party directly 
from the campus law enforcement unit. 
A school official also commented that, 
under the proposed definition, it is not 
clear whether using law enforcement 
unit records during a disciplinary 
proceeding would render the records 
“disciplinary records” and thus 
“education records” subject to FERPA. 

A commenter from a State educational 
agency asked for clarification on 
whether a record of a law enforcement 
unit can lose its status and become an 
“education record,” 

Discussion: FERPA was amended by 
Congress to exempt from the definition 
of “education records” those records 
that are created by a law enforcement 
unit for a law enforcement purpose and 
maintained by that law enforcement 
unit, thus allowing educational agencies 
and institutions to disclose these 
records publicly without obtaining prior 



written consent. If a law enforcement 
unit of an institution creates a record for 
law enforcement purposes and provides 
a copy of that record to a dean, 
principal, or other school official for use 
in a disciplinary proceeding, that copy 
is an “education record” subject to 
FERPA if it is maintained by the dean, 
principal, or other school official and 
not the law enforcement unit. The 
original document created and 
maintained by the law enforcement unit 
is not an “education record” and does 
not become an “education record” 
merely because it was shared with 
another component of the institution. 

Change: None. 

Comments: A few commenters said 
that the proposed definition of “law 
enforcement unit” was too broad and 
could encompass offices or components 
within an institution that may maintain 
information directly related to students 
but that are responsible for the 
institution’s compliance with Federal 
civil rights laws, financial aid 
regulations, hiring requirements, etc., 
which should not be considered law 
enforcement activities under FERPA. It 
was also suggested that the definition be 
limited to enforcement of “criminal” 
laws. 

Discussion: The proposed definition 
is intended to cover that part of the 
institution which is responsible for 
providing and maintaining a safe and 
orderly school environment by 
monitoring and dealing with the 
conduct of individuals, not the 
institution itself. After considering these 
comments, the Secretary agrees that the 
definition is potentially too broad and 
may encompass functions of the 
institution, such as an office of legal 
counsel, that should not be included. 
However, the Secretary believes that 
adding “criminal” to the definition 
might unnecessarily restrict or confuse 
school officials as to their 
responsibilities for ensuring school 
safety. 

Changes: The Secretary has revised 
the definition of “law enforcement unit” 
by adding a new provision to clarify that 
it pertains to those individuals or parts 
of the institution responsible for 
maintaining the safety and security of 
school surroundings and for enforcing 
laws against individuals and 
organizations within the school 
community and not those responsible 
for the institution’s own compliance 
with various laws. 

Comments: Several commenters 
associated with postsecondary 
institutions stated that they did not 
believe, for various reasons, that their 
campus security departments were “law 
enforcement units” under FERPA and 



o 

ERiC 



requested clarification on the status of 
the records of what they considered a 
“non-law enforcement” campus security 
department. Some commenters also 
noted that a majority of colleges and 
universities do not employ “campus 
police officers” who possess police 
authority or perform official police 
functions. Instead, many institutions 
employ non-commissioned “campus 
security officers” whose main function 
is to keep the peace and enforce 
institutional policies. Another 
commenter noted that the definition of 
“law enforcement unit” was potentially 
confusing because student conduct code 
offenses are considered violations of the 
“law” and that an office that is 
responsible for student conduct might 
be considered a “law enforcement unit” 
under the definition. 

Discussion: The Secretary has taken 
into consideration these comments and 
has revised the regulations to clarify 
that the term “law enforcement unit” 
under FERPA includes “a unit of 
commissioned police officers or non- 
commissioned security guards.” That is, 
security departments such as those 
described by the commenters would be 
considered “law enforcement units” if 
they are officially authorized or 
designated by the institutions to carry 
out the functions listed in the regulatory 
definition, regardless of whether the 
individuals of that unit are 
commissioned police officers. The 
second part of the definition of law 
enforcement unit makes it clear that a 
security department retains its status as 
a “law enforcement unit” even if it also 
has responsibility for enforcing the 
institution’s code of student conduct. 

Change: The definition has been 
revised to state that it applies to units 
consisting of commissioned police 
officers as well as non-commissioned 
security guards. 

Comments: One commenter, an 
official at a major university, stated that 
the law enforcement unit at that 
institution generates both “crime 
reports,” which it considers public 
documents, and “incident reports,” 
which are treated as education records 
and referred to the student affairs office 
for disciplinary purposes. The official 
further stated that he believes that the 
functions of the law enforcement unit 
and the functions of the student affairs 
office charged with administering the 
student discipline system are 
intertwined at his institution as they are 
at other institutions. 

Discussion: If an institution has a 
security unit or individual with a dual 
role or function of enforcing 
institutional rules of conduct related to 
safety and security and referring 
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potential or alleged violations of law to 
government authorities, that unit or 
individual would be considered a “law 
enforcement unit” under FERPA. Under 
the new amendment, records of that 
unit that were created and maintained 
for a law enforcement purpose are 
considered records of a law enforcement 
unit and, therefore, excluded from the 
definition of “education records” under 
FERPA. 

The Secretary has revised the 
proposed regulations to clarify that 
where a law enforcement unit also 
performs non-law enforcement 
functions, the records created and 
maintained by that unit are considered 
law enforcement unit records, even 
where those records were created for 
dual purposes (e.g. for both law 
enforcement and disciplinary purposes). 
Only records that were created and 
maintained by the unit exclusively for a 
non-law enforcement purpose will not 
be considered records of a law 
enforcement unit. For example, if a 
campus security unit initiates an 
investigation into an incident on 
campus relating to a possible violation 
of law or the student conduct code, the 
record created and maintained by the 
unit in connection with this 
investigation is a law enforcement unit 
record, whether or not it is ever referred 
to the local police authorities. If, 
however, the same unit or individual 
responsible for law enforcement 
investigates an incident for the purposes 
of internal disciplinary actions and 
creates a record exclusively for the 
purpose of a possible disciplinary action 
against the student, that record would 
not be considered a record of a law 
enforcement unit and would be an 
“education record” subject to FERPA. It 
should be stressed that the Secretary 
expects such occasions to be very rare, 
especially with incidents involving 
criminal conduct by students at 
postsecondary institutions. 

Postsecondary institution officials 
should note also that when they decide 
to refer a matter to a disciplinary 
committee rather than to the 
institution’s own law enforcement unit 
or directly to governmental law 
enforcement authorities, the institution 
is not relieved of its responsibilities for 
complying with the reporting 
requirements of the Student Right-to- 
Know and Campus Security Act, as 
codified in 34 CFR 668.47(a)(6) (Student 
Assistance General Provisions). 

Changes: The definition has been 
clarified by the insertion of the word 
“exclusively” to indicate records 
created and maintained exclusively for 
internal disciplinary purposes are not 
law enforcement unit records and are, 



therefore, not excluded from the 
definition of “education records.” 

Comments: One commenter suggested 
that the regulations be changed to allow 
institutions that may not have a law 
enforcement unit to publicly disclose 
records that relate to a criminal act but 
which are not necessarily related to a 
disciplinary action. 

Another commenter expressed 
concern that, because most public 
elementary and secondary schools do 
not have a “law enforcement unit,” an 
individual administrator could be 
considered a “law enforcement unit” 
under the proposed definition. The 
commenter believed this dual role of 
school administrator and law 
enforcement official could pose a 
potential problem for abuse because of 
his or her access to both education 
records and law enforcement unit 
records. He stated that, in such a 
circumstance, a school official could 
“essentially confer or remove parents’ 
rights of access to records, or maintain 
or eliminate confidentiality with respect 
to certain records by choosing to 
characterize documents as education 
records or records of a law enforcement 
unit.” 

Discussion: The Secretary has 
carefully considered whether provisions 
should be included in the regulations to 
address these concerns. The definition 
of “law enforcement unit” has been 
clarified by adding the term “officially” 
to describe an office, department, or 
individual who is authorized or 
designated by the agency or institution 
to perform law enforcement unit 
functions. Additionally, a subsection 
has been added to the definition to 
further describe a “law enforcement 
unit” as an entity or individual whose 
function is to maintain the safety and 
security of the institution. 

The inclusion of the term 
“individual” is intended to permit small 
educational agencies and institutions to 
designate a single individual 
responsible for “law enforcement” and 
related safety and security functions. 

The records created and maintained by 
that individual for a law enforcement 
purpose may be disclosed, without prior 
consent of the parent or eligible student 
to whom the records relate, and the 
parent or eligible student would have no 
right to inspect and review the records 
under FERPA. The Secretary believes 
that. the benefits gained by safer school 
surroundings outweigh any potential 
problems for abuse of the privacy or 
access rights under FERPA that might 
occur by including “individual” in the 
definition. 

However, the Secretary does not have 
the authority to change the regulations 



to allow institutions that do not have a 
law enforcement unit to publicly 
disclose records that relate to a criminal 
act. Such a change would have to be 
made by Congress. 

Change: The Secretary has revised the 
definition of “law enforcement unit” to 
include only entities or individuals 
officially authorized or designated by an 
agency or institution to enforce local or 
State law, or to refer to appropriate 
authorities a matter for enforcement of 
these laws, or to maintain the physical 
security and safety of the agency or 
institution. 

Comments: A couple of commenters 
from State departments of education 
noted that the definition of law 
enforcement unit should be clarified to 
include a city police officer hired by a 
local educational agency or through 
special arrangements with local law 
enforcement authorities. 

Discussion: The Secretary believes 
that the definition of “law enforcement 
unit” which includes the term 
“individual,” as discussed in the 
previous comment, will allow schools to 
designate a single individual 
responsible for “law enforcement” and 
related safety and security functions. 
However, educational agencies and 
institutions should also be aware of the 
requirement under § 99.6 of the FERPA 
regulations to adopt a policy regarding 
how the agency or institution meets the 
requirements of FERPA. In that policy, 
educational agencies and institutions 
are required to include a specification of 
the criteria for determining which 
parties are school officials and what the 
agency or institution considers to be a 
legitimate educational interest. If 
agencies and institutions have a policy 
of disclosing information from 
education records to officials of their 
own law enforcement unit, the officials 
of that unit must be designated under 
the school’s FERPA policy as school 
officials with a legitimate educational 
interest. The Department can provide 
further guidance on the formulation of 
such a policy. 

The Secretary encourages educational 
agencies and institutions that do not 
have a separate law enforcement unit to 
develop working relationships with 
local police authorities. However, 
FERPA currently prohibits schools from 
disclosing information from education 
records to local police authorities absent 
the prior written consent of parents or 
a lawfully issued subpoena or court 
order. 

Changes: None. 

Comment: One commenter expressed 
concern that the proposed regulations 
do not permit officials of an institution’s 
law enforcement unit to disclose 
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information that the unit had obtained 
from a student’s education records to 
local police or prosecutors. He believes 
that the regulations, as proposed, would 
impede the institution’s ability to 
investigate students suspected of 
falsified time sheets, transcript forgery, 
computer fraud, and similar crimes that 
may be demonstrated by documents 
considered “education records” under 
FERPA. 

Discussion: An institution may 
disclose education records to an outside 
law enforcement agency without 
consent to comply with a judicial order 
or lawfully issued subpoena. The 
Secretary does not have the statutory or 
regulatory authority to permit the non- 
consensual disclosure of education 
records to outside law enforcement 
authorities in other circumstances. Any 
changes to this provision would have to 
be made by Congress. 

Changes: None, 

Comment: The same commenter 
proposed that § 99.8(c)(1) be changed by 
replacing “contacting its law 
enforcement unit, orally or in writing” 
with “disclosing education records or 
information from education records to 
its law enforcement unit.” 

Discussion: This provision was 
included in order to clarify that the 
Secretary would not consider an 
institution “contacting” its own law 
enforcement officials regarding 
suspected criminal activity to involve 
necessarily the disclosure of 
information from an education record, 
which the institution would not be 
permitted to do under FERPA unless 
those individuals had been designated 
in the school’s FERPA policy as “school 
officials” with legitimate educational 
interest in accordance with 34 CFR 99,6. 

Additionally, as referenced in the 
previous comment, FERPA does not 
permit any party, including the 
institution’s own law enforcement unit, 
that has received information from 
education records to redisclose that 
information without the prior consent of 
the parent or eligible student or in 
accordance with one of the exceptions 
listed under 34 CFR 99.31, which 
includes disclosure in compliance with 
a judicial order or lawfully issued 
subpoena. 

Changes: None. 

Comments: A commenter from a large 
metropolitan school district agreed that 
exempting law enforcement unit records 
from the definition of “education 
records” promotes cooperation between 
local police agencies and local 
educational agencies in their efforts to 
reduce violence on school campuses. He 
further stated, however, that to regard 
disciplinary records as “education 



records,” which cannot be disclosed to 
the school district’s own law 
enforcement unit, obstructs a law 
enforcement unit official’s ability to 
maintain a safe school environment. In 
contrast, a commenter from a State 
educational agency, who agreed with 
the Secretary’s proposed regulatory 
definition of “law enforcement unit,” 
stated that the proposed change would 
allow schools to disclose to the public 
records created and maintained by 
school law enforcement units. He 
further noted, without explanation, that 
the change would assist public schools 
in working with local law enforcement 
authorities and other agencies to 
provide the best education for students 
in a safe environment conducive to 
learning. 

Discussion: With regard to the first 
commenter’s concern that FERPA 
prevents the disclosure of information 
from disciplinary records to the school 
district’s designated law enforcement 
unit, as discussed in the previous 
comment section, FERPA does not 
prevent such a disclosure if the officials 
of the law enforcement unit have been 
designated as “school officials” with a 
legitimate educational interest under the 
district’s student records policy, as 
required by 34 CFR 99.6. However, 
FERPA does prohibit an educational 
agency or institution from disclosing 
information from education records, 
including information from disciplinary 
records, to an outside, governmental law 
enforcement authority, except in certain 
circumstances such as in response to a 
judicial order or lawfully issued 
subpoena, provided notice requirements 
of § 99.31(a)(9) have been met. As 
previously noted, the Secretary does not 
have the statutory or regulatory 
authority to permit the non-consensual 
disclosure of information from 
education records, such as disciplinary 
records, to third parties, including 
governmental law enforcement 
authorities. 

Changes: None. 

Comments: A few commenters noted 
that students who are victims of crime 
should have a right to know about the 
progress of the investigation of their 
cases. In contrast, several commenters 
suggested that information regarding 
active criminal investigations be 
protected from disclosure until the 
investigations have been closed or 
adjudicated. 

Discussion: The Secretary has 
considered these comments but believes 
that because agencies and institutions 
are permitted, not required, by FERPA 
to publicly disclose information from 
law enforcement unit records, schools 
should develop their own policies with 



regard to if and when they will disclose 
the information. 

Changes: None. 

Paperwork Reduction Act of 1980 

These proposed regulations have been 
examined under the Paperwork 
Reduction Act of 1980 and have been 
found to contain no information 
collection requirements. 

Assessment of Educational Impact 

In the NPRMs, the Secretary requested 
comments on whether the proposed 
regulations would require transmission 
of information that is being gathered by 
or is available from any other agency or 
authority of the United States. 

Based on the response to the NPRMs 
and on its own review, the Department 
has determined that the regulations in 
this document do not require 
transmission of information that is being 
gathered by or is available from any 
other agency or authority of the United 
States. 

List of Subjects in 34 CFR Part 99 

Administrative practice and 
procedure, Education, Family 
educational rights, Privacy, Parents, 
Reporting and recordkeeping 
requirements, Students. 

Dated: January 10, 1995 
Richard W. Riley, 

Secre tary of Education , 

(Catalog of Federal Domestic Assistance 
Number does not apply.) 

The Secretary amends Part 99 of Title 
34 of the Code of Federal Regulations as 
follows: 

PART 99— FAMILY EDUCATIONAL 
RIGHTS AND PRIVACY 

1. The authority citation for part 99 
continues to read as follows: Authority: 
20 U.S.C. 1232g, unless otherwise 
noted. 

2. Section 99.3 is amended by 
republishing the introductory text of 
paragraph (b) and revising paragraph 
(b)(2) in the definition of “Education 
records” and by adding a new definition 
of “Disciplinary action or proceeding” 
in alphabetical order to read as follows: 

§ 99.3 What definitions apply to these 
regulations? 

***** 

Disciplinary action or proceeding 
means the investigation, adjudication, 
or imposition of sanctions by an 
educational agency or institution with 
respect to an infraction or violation of 
the internal rules of conduct applicable 
to students of the agency or institution. 
***** 

Education records * * * 
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(b) The term does not include: 
***** 

(2) Records of the law enforcement 
unit of an educational agency or 
institution, subject to the provisions of 
§99.8. 

***** 

3. A new § 99.8 is added to subpart A 
to read as follows: 

§ 99.8 What provisions apply to records of 
a law enforcement unit? 

(a)(1) Low enforcement unit means 
any individual, office, department, 
division, or other component of an 
educational agency or institution, such 
as a unit of commissioned police 
officers or non-commissioned security 
guards, that is officially authorized or 
designated by that agency or institution 
to — 

(i) Enforce any local, State, or Federal 
law, or refer to appropriate authorities a 
matter for enforcement of any local, 
State, or Federal law against any 
individual or organization other than 
the agency or institution itself; or 

(ii) Maintain the physical security and 
safety of the agency or institution. 



(2) A component of an educational 
agency or institution does not lose its 
status as a low enforcement unit if it 
also performs other, non-law 
enforcement functions for the agency or 
institution, including investigation of 
incidents or conduct that constitutes or 
leads to a disciplinary action or 
proceedings against the student. 

(b)(1) Records of a law enforcement 
unit means those records, files, 
documents, and other materials that 
are — 

(1) Created by a law enforcement unit; 

(ii) Created for a law enforcement 
purpose; and 

(iii) Maintained by the law 
enforcement unit. 

(2) Records of a law enforcement unit 
does not mean — 

(i) Records created by a law 
enforcement unit for a law enforcement 
purpose that are maintained by a 
component of the educational agency or 
institution other than the law 
enforcement unit; or 

(ii) Records created and maintained 
by a law enforcement unit exclusively 
for a non-law enforcement purpose, 







such as a disciplinary action or 
proceeding conducted by the 
educational agency or institution. 

(c) (1) Nothing in the Act prohibits an 
educational agency or institution from 
contacting its law enforcement unit, 
orally or in writing, for the purpose of 
asking that unit to investigate a possible 
violation of, or to enforce, any local, 
State, or Federal law. 

(2) Education records, and personally 
identifiable information contained in 
education records, do not lose their 
status as education records and remain 
subject to the Act, including the 
disclosure provisions of §99.30, while 
in the possession of the law 
enforcement unit. 

(d) The Act neither requires nor 
prohibits the disclosure by an 
educational agency or institution of its 
law enforcement unit records. 

(Authority: 20 U.S.C. 1 23 2g(a)(4)(B)(ii)) 

[FR Doc. 95-1000 Filed 1-13-95; 8:45 am] 

BILLING CODE 4000-01-P 
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DEPARTMENT OF EDUCATION 

34 CFR Part 99 
RIN 1880-AA65 

Family Educational Rights and Privacy 

AGENCY: Department of Education. 
ACTION: Final regulations. 

SUMMARY: The Secretary amends the 
regulations implementing the Family 
Educational Rights and Privacy Act 
(FERPA). The amendments are needed 
to implement section 249 of the 
Improving America’s Schools Act of 
1994 (IASA) (Pub. L. 103-382, enacted 
October 20, 1994), to eliminate 
unnecessary requirements, reduce 
regulatory burden, and incorporate 
several technical changes. 

EFFECTIVE DATE: These regulations take 
effect December 23, 1996. 

FOR FURTHER INFORMATION CONTACT: 

Ellen Campbell, U.S. Department of 
Education, 600 Independence Avenue, 
SW., Washington, DC 20202-4605. 
Telephone: (202) 260-3887. Individuals 
who use a telecommunications device 
for the deaf (TDD) may call the Federal 
Information Relay Service (FIRS) at 1- 
800-877-8339 between 8 a.m. and 8 
p.m., Eastern time, Monday through 
Friday. 

SUPPLEMENTARY INFORMATION: On March 
14, 1996, the Secretary published a 
notice of proposed rulemaking (NPRM) 
for 34 CFR part 99 in the Federal 
Register (61 FR 10664-10669). The 
preamble to the NPRM included a 
summary and discussion of the 1994 
amendments and other major issues that 
were addressed in the proposed 
regulations. 

These regulations have been reviewed 
and revised in accordance with the 
Department’s “Principles for 
Regulating,” which were developed to 
ensure that the Department regulates in 
the most flexible, most equitable, and 
least burdensome way possible. These 
principles advance the regulatory 
reinvention and customer service 
objectives of the Administration’s 
National Performance Review and are 
essential to an effective partnership 
with States and localities. The Secretary 
amends these regulations because he 
believes they are necessary to 
implement the law and give the greatest 
flexibility to educational agencies and 
institutions. In addition, the regulations 
minimize burden while protecting 
parents’ and students’ rights. 

The final regulations include changes 
made to the statute by the Improving 
America’s Schools Act of 1994 (IASA). 
The IASA amended FERPA so that State 



educational agencies are required to 
afford parents access to education 
records they maintain. The IASA also 
amended FERPA to permit 
nonconsensual disclosures of education 
records to officials in the State juvenile 
justice system as permitted by State law 
and, in certain circumstances, to permit 
the nonconsensual disclosure of 
information regarding disciplinary 
action taken against a student for 
behavior that posed a significant risk to 
the student or others. 

Additionally, these regulations reflect 
the Department’s effort to reduce 
unnecessary regulatory burdens. In this 
regard, the Department is removing the 
nonstatutory requirement that schools 
adopt a formal written student records 
policy. Instead, schools will now be 
required to include additional 
information in the annual notification of 
rights, which is required by statute, to 
ensure that parents are effectively 
notified of their rights and how to 
pursue them. 

In reviewing the NPRM with respect 
to the issue of disclosing education 
records without consent pursuant to 
subpoenas and court orders, the 
Secretary has concluded that the 
language in this provision of the 
regulations should be revised to 
highlight that notification to the parent 
or eligible student of a subpoena or 
judicial order allows the parent or 
student the opportunity to seek 
protective action to prevent re- 
disclosures. Also, the Secretary clarifies 
that if an educational agency or 
institution initiates legal action against 
a parent or student, the records that can 
be disclosed are those records of that 
student that are relevant to the action. 
These additions are not intended to 
change the meaning of the regulatory 
requirements as published in the NPRM, 
but are merely a clarification of the 
Department’s position on this issue. 
Changes made in response to the public 
comments on the NPRM are discussed 
in the following section. 

Analysis of Comments and Changes 

In response to the Secretary’s 
invitation in the NPRM, twenty-eight 
(28) parties submitted comments on the 
proposed regulations. An analysis of the 
public comments and of the changes in 
the regulations since publication of the 
NPRM follows. Substantive issues are 
discussed under the section of the 
regulations to which they pertain. 
Suggested changes and comments 
outside the scope of the NPRM are not 
addressed because the Secretary lacks 
the statutory authority to make the 
changes. 



Annual Notification of Rights (§99.7) 

Comments: Seven commenters 
submitted letters in support of the 
proposal to remove the requirement that 
educational agencies and institutions 
adopt student records policies. One 
commenter stated that the proposed 
change would not only lessen the 
burden on schools, but would facilitate 
communication between the schools 
and parents or eligible students. This 
commenter further stated that the cost 
associated with the change would not be 
significant because the school district 
updates its notices regardless of 
statutory requirements. Another 
commenter, representing a State 
educational agency (SEA), stated that 
the proposed changes would “be of 
benefit to parents.” Another commenter 
representing a large public university 
stated that “the flexibility offered by not 
requiring having such a [student 
records] policy is a laudable goal * * *. 
A move toward that type of freedom is 
a positive one.” 

Six commenters opposed the 
proposed change. One commenter stated 
that the current requirements are not 
burdensome. Two commenters noted 
that the policy is helpful in educating 
school officials about FERPA 
requirements and that the change in the 
requirements would be burdensome on 
schools because they would incur costs 
to publish a longer notification. 

Discussion: The Secretary’s purpose 
in removing the requirement that 
schools maintain a policy is twofold. 
Specifically, the Secretary believes that 
this change will help to ensure that 
parents and eligible students receive 
more effective notification of their rights 
under the law, including how to pursue 
those rights. Second, the Secretary 
hopes that the change will afford 
educational agencies and institutions 
greater flexibility by removing 
requirements that are not necessary to 
implement the law. 

With respect to those commenters 
who noted that the student records 
policy is helpful in educating school 
officials about FERPA, the removal of 
the requirement that educational 
agencies or institutions adopt a formal 
student records policy does not prevent 
schools from maintaining a policy. The 
Department will continue to update and 
make available a sample model student 
records policy for any educational 
agencies and institutions that want to 
have a policy. 

While the Secretary encourages 
educational agencies and institutions to 
develop and utilize student records 
policies, he also recognizes that the 
statute does not require that schools 
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have these policies. Because of this 
regulatory requirement, the Department 
has had to investigate complaints 
alleging that the contents of schools’ 
student records policies did not meet 
the regulatory requirements. Often, the 
Department found that the policies did 
not comply. 

The removal of the requirement to 
adopt a written policy aligns the FERPA 
regulations more closely to the statute 
and gives educational agencies and 
institutions flexibility regarding the 
content of their student records policies. 
In addition, the amount of Department 
resources spent on investigating 
complaints alleging violations of 
regulatory requirements that are not 
based on statutory requirements will be 
reduced. 

In response to those comments that 
expressed concern regarding the burden 
and cost of publishing additional 
information in an annual notification, 
the Secretary has again reviewed the 
regulations. The Secretary has 
determined that some of the information 
proposed to be included in the annual 
notification is not necessary to meet the 
statutory requirement. In particular, the 
Secretary has removed the requirement 
that the notice list FERPA’s exceptions 
to the prior written consent provision. 

In addition, the Secretary will not 
require that the annual notification 
specify the procedures for a hearing 
under FERPA’s amendment provision, 
as long as schools provide this 
information to parents and eligible 
students seeking to amend education 
records. Lastly, the Secretary will not 
require the annual notification to 
include a reference to directory 
information. 

The Department has created a model 
annual notification that is not 
significantly longer than the previous 
annual notification. The model is 
available from the address listed in the 
FOR FURTHER INFORMATION CONTACT 
section of these regulations and is 
published as an appendix to these 
regulations. The model is less than two 
8 V 2 " by 11 " pages in length (single- 
spaced), minimizing any additional 
burden on an institution. As noted in 
the NPRM, the Secretary will allow 
educational agencies and institutions up 
to three years to transfer from the 
current policy requirements and to 
implement the new requirements 
concerning an annual notification. 

Changes: The Secretary has removed 
proposed § 99.7(a)(3)(ii) (B) and (C), 

§ 99.7(a)(3)(iii), and §99.7(a)(3)(v). The 
remaining provisions have been 
renumbered accordingly. 



Effective Notification 

Comment: One commenter requested 
that the regulations specify what would 
be acceptable notification to individuals 
with disabilities or those with limited 
English proficiency. 

Discussion: The Secretary believes 
that each school is best able to 
determine what would constitute notice 
that would be reasonably likely to 
inform parents and eligible students 
whom it serves. The regulations give 
schools flexibility to determine how to 
effectively notify individuals with 
disabilities and those who have a 
primary or home language other than 
English. Schools must provide notice 
consistent with applicable civil rights 
laws. Effectively notifying individuals 
with disabilities may include, for 
example, providing notice in alternative 
formats such as audiotape, braille, 
computer diskette, or large print, as 
appropriate. Ideally, schools would 
consult with parents and eligible 
students in determining how best to 
provide them with notice. 

Changes: None. 

Annual Requirement 

Comment: One commenter questioned 
the requirement that an educational 
agency or institution provide the 
notification annually. This commenter 
suggested that notification be made 
once, when a student first enters the 
school. 

Discussion: The Secretary believes 
that requiring an annual notification 
that is reasonably likely to inform 
parents and eligible students of their 
rights strikes the proper balance 
between placing minimal requirements 
on educational agencies and institutions 
and ensuring that parents and students 
are effectively informed of their rights. 
The Department does not require 
schools to individually notify parents or 
eligible students of their rights, but only 
that they give notice that is reasonably 
likely to inform the parents and 
students of their rights. 

Changes: None, 

Right To Inspect and Review Education 
Records (Section 99.10) 

Comments: Eleven SEAs submitted 
comments on the NPRM. Most 
commenters agreed that the Secretary’s 
proposed requirement that access be 
provided within 45 days is reasonable. 
One commenter, while generally in 
favor of the proposed changes, stated 
that the 45-day time period was too 
long. 

Discussion : Because most comments 
the Department received stated that the 
45-day requirement is reasonable and 



the statute requires that LEAs respond 
to requests for access within 45 days, 
the Secretary believes that making the 
response time consistent with the 
statutory requirement for LEAs will be 
less confusing to parents, students, and 
school officials. 

Changes: None. 

Costs Associated With Making Records 
Available 

Comments: One commenter stated 
that SEAs would incur significant costs 
producing records for review. 

Discussion : The Secretary recognizes 
that there may be some personnel and 
resource costs associated with affording 
access to records. However, § 99,11 of 
subpart B of the FERPA regulations 
allows SEAs to charge a fee for a copy 
of education records that is made for a 
parent or eligible student. This fee 
would cover most of the nominal costs 
associated with making records 
available to parents and eligible 
students. 

Changes: None. 

Duplicate Records 

Comments: Two commenters 
suggested that SEAs should not be 
required to provide access to records 
that are duplicates of records 
maintained by an LEA. 

Discussion: The requirement that 
SEAs provide access to education 
records is statutory. Congress did not 
make an exception for duplicate 
records. There is, therefore, no authority 
for the Department to limit a parent’s or 
eligible student’s right to access records 
maintained by an SEA, even if the 
records are duplicates of those records 
maintained by an LEA. 

Changes: None. 

Prior Consent Provisions 

Comments: Three commenters 
contended that FERPA’s provisions 
requiring the consent of the parent or 
eligible student prior to disclosure of 
education records also should apply to 
records maintained by SEAs, 
notwithstanding the source of the 
records. 

Discussion: Congress only requires 
that SEAs comply with the access 
provisions of FERPA. SEAs are not 
required to comply with any of the other 
provisions of FERPA, such as the 
written consent requirement or the 
notification requirement. Accordingly, 
the Secretary has no authority to require 
SEAs to comply with FERPA’s prior 
consent provisions. 

Changes ; None. 

SEAs and Annual Notification 

Comments: Several commenters 
representing SEAs asked if the annual 
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notification requirement applies to 
SEAs and if state-wide notification is 
required. 

Discussion: As discussed in the 
preamble to the NPRM, FERPA does not 
apply to SEAs in general. Rather, the 
only provision in FERPA that applies to 
SEAs directly is the requirement that 
SEAs provide parents and eligible 
students access to education records 
when so requested. Accordingly, 
FERPA’s notification requirement does 
not apply to an SEA, unless the SEA is 
an educational agency or institution 
under § 99.1 of this part. 

Changes: None. 

Foster Parents 

Comments: One commenter was 
concerned that there was no proposed 
provision addressing the rights of a 
foster parent to inspect and review 
education records at an SEA. 

Discussion: The regulations already 
define the term parent in § 99.3 to 
include “a parent of a student and 
includes a natural parent, a guardian, or 
an individual acting as a parent in the 
absence of a parent or a guardian.” 

Thus, foster parents who are acting as a 
child’s parent would have the rights 
afforded parents under FERPA with 
respect to that child’s education records. 

Changes: None. 

Prior Consent Not Required for 
Disclosures Pursuant to Court Orders 
and Lawfully Issued Subpoenas (Section 
99.31) Subpoenas of Other Issuing 
Agencies 

Comments: Three commenters noted 
that the NPRM omitted statutory 
language that allows an educational 
institution to release education records 
without notifying the student when an 
agency (other than a court) issues a 
subpoena for a law enforcement 
purpose. 

Discussion: The words “or other 
issuing agency” were inadvertently 
excluded from the NPRM. The 
Department did not intend to limit the 
application of this provision and has 
corrected the regulations to reflect the 
statutory language. 

Change: The words “or other issuing 
agency” have been added to 
§99.31(a)(9)(ii)(B). 

Implied Waiver of the Right To Consent 

Comments: Three commenters 
requested that the Secretary include 
regulations allowing an educational 
agency or institution to assume an 
implied waiver of the right to consent to 
the disclosure of education records to 
respond to a lawsuit filed by a parent or 
student against the agency or 
institution. 



Discussion: While FERPA does not 
directly address this issue, the 
Department interprets FERPA to allow 
an educational agency or institution to 
infer the parent’s or student’s implied 
waiver of the right to consent to the 
disclosure of information from the 
student’s education records if the parent 
or student has sued the institution. The 
Secretary believes this interpretation is 
sound because an educational agency or 
institution must be able to defend itself 
if a parent or student has initiated legal 
action against the agency or institution. 
This interpretation, however, does not 
place a requirement on educational 
agencies or institutions, and thus it is 
not included in the regulations. 

Changes: None. 

Disclosure of Information from 
Disciplinary Records (Section 99.36) 

Comment: One commenter asked if an 
educational agency or institution may 
include information regarding 
disciplinary actions taken against a 
student other than those for conduct 
that posed a significant risk to the 
health or safety of the student or others 
in a student’s education records. 

Discussion: Neither FERPA nor the 
regulations prevent an educational 
agency or institution from maintaining 
any type of education records that an 
agency or institution has deemed 
necessary or appropriate to maintain. 
The new statutory provision, upon 
which the new regulatory provision is 
based, merely clarifies that nothing in 
FERPA prevents schools from 
maintaining, and disclosing under 
certain circumstances, specific 
information regarding disciplinary 
action taken against students. 

Changes: None. 

Health or Safety Emergency Exception 

Comments: One commenter suggested 
that the new provision regarding 
disciplinary records be placed in its 
own section of the regulations, stating 
that Congress did not include this 
provision under the health or safety 
emergency exception to FERPA’s prior 
written consent provision. 

Discussion: The new provision 
governs disclosure of information about 
a student’s behavior that poses 
significant risk to that student or other 
individuals. This new provision is 
closely related to, and logically follows, 
the existing health or safety exception to 
the prior written consent provision. The 
placement of the new provision in the 
same subpart with the previous health 
or safety emergency exception does not 
collapse the two provisions. 

Changes: None. 



Obligation To Disclose Information 

Comments: A couple of commenters 
asked whether the FERPA provision 
permitting the disclosure of information 
concerning disciplinary action taken 
against a student for behavior that posed 
a significant risk to that student or other 
individuals creates a legal obligation to 
disclose this information, which would 
make educational agencies and 
institutions liable if this information 
were not disclosed. 

Discussion: These regulations do not 
require the disclosure of any 
information from education records, 
except to the extent that the regulations 
afford parents and eligible students the 
right to access education records. 
Accordingly, the regulations do not 
create a legal obligation to disclose 
information from a student’s 
disciplinary records under FERPA. 
Rather, the regulations give individual 
schools the discretion to determine the 
circumstances under which it is 
appropriate to disclose information. 

Changes: None. 

Behavior That Poses a Significant Risk 

Comments: Some commenters 
suggested that the Department should 
clarify what behavior would constitute 
“behavior that posed a significant risk” 
and pointed out that a particular 
behavior at one institution may be 
deemed acceptable, and at another be 
considered putting the individual or 
others at “significant risk.” 

Discussion: The Secretary believes 
that defining a single standard of what 
constitutes behavior that posed a 
significant risk would restrict 
educational agencies and institutions 
from determining what is appropriate 
based on specific circumstances found 
at individual schools. 

Change: None. 

Transfer of Student Education Records 

Comments: Three commenters 
suggested permitting nonconsensual 
disclosure of information concerning 
disciplinary action taken against a 
student for behavior that posed a 
significant risk to that student or other 
individuals if the student has 
transferred to another school. 

Discussion : FERPA has always 
permitted, under § 99.31(a)(2), 
nonconsensual disclosure of this 
information (and other education 
records) in situations where students are 
seeking or intending to enroll in another 
educational agency or institution. If a 
student has been enrolled in the new 
institution for a period of time, the 
Secretary interprets § 99.31(a)(2) to 
permit educational agencies and 
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institutions to send corrected education 
records, or additional education records, 
to the new institution (if it has already 
sent education records under this 
exception) as part of an original 
disclosure. 

Change: None. 

Students With Disabilities 

Comment: One commenter asked if 
the new provision permitting 
nonconsensual disclosure of 
information concerning disciplinary 
action applies to students with 
disabilities. 

Discussion: FERPA applies to all 
education records equally, and does not 
distinguish between the records of 
students with disabilities and the 
records of other students. Moreover, the 
Secretary believes that individual 
educational agencies and institutions 
are in the best position to determine 
what information should be released in 
a particular situation. However, if a 
complaint is filed, the Department, 
through the Family Policy Compliance 
Office, would investigate the complaint 
and make a final determination whether 
FERPA had been violated. 

Changes : None. 

Disclosure of Information Concerning 
Juvenile Justice System (Section 99.38) 

Comment: None. 

Discussion: The Secretary believes 
that each school, working in 
conjunction with State and local 
authorities, can best determine whether 
a release of personally identifiable 
information from an education record 
“concerns the juvenile justice system’s 
ability to effectively serve a student 
prior to adjudication.” Thus, the 
regulations give schools flexibility in 
determining whether an education 
record of a juvenile may be released 
without the prior written consent of the 
parent. 

Executive Order 12866 

Assessment of Costs and Benefits 

These final regulations have been 
reviewed in accordance with Executive 
Order 12866. Under the terms of the 
order the Secretary has assessed the 
potential costs and benefits of this 
regulatory action. 

The potential costs associated with 
the final regulations are those resulting 
from statutory requirements and those 
determined by the Secretary as 
necessary for administering this 
program effectively and efficiently. 
Burdens specifically associated with 
information collection requirements 
were identified and explained in the 
preamble to the NPRM published on 



March 14, 1996. This discussion 
appeared under the heading Paperwork 
Reduction Act of 1995 (61 FR 10666). 

In assessing the potential costs and 
benefits — both quantitative and 
qualitative — of these final regulations, 
the Secretary has determined that the 
benefits of the regulations justify the 
costs. 

Summary of Potential Costs and 
Benefits 

The potential costs and benefits of 
these final regulations are discussed 
elsewhere in this preamble under the 
following heading: Analysis of 
Comments and Changes. 

Paperwork Reduction Act of 1995 

Sections 99.7 and 99.32 contain 
information collection requirements and 
have been approved by OMB under 
control number 1880-0508. Under the 
Paperwork Reduction Act of 1995, no 
persons are required to respond to a 
collection of information unless it 
displays a valid OMB control number. 
The valid OMB control number assigned 
to the collection of information in these 
final regulations is displayed at the end 
of the affected sections of the 
regulations. 

Assessment of Educational Impact 

In the notice of proposed rulemaking, 
the Secretary requested comments on 
whether the proposed regulations would 
require transmission of information that 
is being gathered by or is available from 
any other agency or authority of the 
United States. 

Based on the response to the proposed 
regulations and on its own review, the 
Department has determined that the 
regulations in this document do not 
require transmission of information that 
is being gathered by or is available from 
any other agency or authority of the 
United States. 

List of Subjects in 34 CFR Part 99 

Administrative practice and 
procedure, Education, Information, 
Privacy, Parents, Records, Reporting and 
recordkeeping requirements, Students. 

Dated: September 18, 1996. 

Richard W. Riley, 

Secretary of Education. 

(Catalog of Federal Domestic Assistance 
Number does not apply.) 

The Secretary amends Part 99 of Title 
34 of the Code of Federal Regulations as 
follows: 

PART 99— FAMILY EDUCATIONAL 
RIGHTS AND PRIVACY 

1. The authority citation for part 99 
continues to read as follows: 



Authority: 20 U.S.C. 1232g, unless 
otherwise noted. 

2. Section 99.1 is amended by 
removing paragraph (b), redesignating 
paragraphs (c), (d), and (e) as paragraphs 
(b), (c), and (d), respectively, and by 
revising paragraph (a) to read as follows: 

§ 99.1 To which educational agencies or 
institutions do these regulations apply? 

(a) Except as otherwise noted in 
§ 99.10, this part applies to an 
educational agency or institution to 
which funds have been made available 
under any program administered by the 
Secretary, if — 

(1) The educational institution 
provides educational services or 
instruction, or both, to students; or 

(2) The educational agency provides 
administrative control of or direction of, 
or performs service functions for, public 
elementary or secondary schools or 
postsecondary institutions. 
***** 

§99.2 [Amended] 

3. Section 99.2 is amended by 
removing the number “438” and adding, 
in its place, the number “444”. 

4. Section 99.3 is amended by 
removing in the definition of “Act” the 
number “438” and adding, in its place, 
the number “444” and by revising the 
definitions of “Disclosure” and 
“Record” to read as follows: 

§ 99.3 What definitions apply to these 
regulations? 

***** 

Disclosure means to permit access to 
or the release, transfer, or other 
communication of personally 
identifiable information contained in 
education records to any party, by any 
means, including oral, written, or 
electronic means. 

***** 

Record means any information 
recorded in any way, including, but not 
limited to, handwriting, print, computer 
media, video or audio tape, film, 
microfilm, and microfiche. 
***** 

§99.6 [Removed and reserved] 

5. Section 99.6 is removed and 
reserved. 

6. Section 99.7 is revised to read as 
follows: 

§ 99.7 What must an educational agency 
or institution include in its annual 
notification? 

(a)(1) Each educational agency or 
institution shall annually notify parents 
of students currently in attendance, or 
eligible students currently in 
attendance, of their rights under the Act 
and this part. 
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(2) The notice must inform parents or 
eligible students that they have the right 
to — 

(i) Inspect and review the student’s 
education records; 

(ii) Seek amendment of the student’s 
education records that the parent or 
eligible student believes to be 
inaccurate, misleading, or otherwise in 
violation of the student’s privacy rights; 

(iii) Consent to disclosures of 
personally identifiable information 
contained in the student’s education 
records, except to the extent that the Act 
and §99.31 authorize disclosure 
without consent; and 

(iv) File with the Department a 
complaint under §§ 99.63 and 99.64 
concerning alleged failures by the 
educational agency or institution to 
comply with the requirements of the Act 
and this part. 

(3) The notice must include all of the 
following: 

(i) The procedure for exercising the 
right to inspect and review education 
records. 

(ii) The procedure for requesting 
amendment of records under § 99.20. 

(iii) If the educational agency or 
institution has a policy of disclosing 
education records under § 99.31(a)(1), a 
specification of criteria for determining 
who constitutes a school official and 
what constitutes a legitimate 
educational interest. 

(b) An educational agency or 
institution may provide this notice by 
any means that are reasonably likely to 
inform the parents or eligible students 
of their rights. 

(1) An educational agency or 
institution shall effectively notify 
parents or eligible students who are 
disabled. 

(2) An agency or institution of 
elementary or secondary education shall 
effectively notify parents who have a 
primary or home language other than 
English. 

(Approved by the Office of Management and 
Budget under control number 1880-0508) 
(Authority: 20 U.S.C. 1232g (e) and (0). 

7. Section 99.10 is amended by 
adding ", or SEA or its component” 
following the word “institution” in 
paragraphs (c) and (e) and by revising 
paragraphs (a), (b), and (d), and the 
authority citation to read as follows: 

§ 99.1 0 What rights exist for a parent or 
eligible student to inspect and review 
education records? 

(a) Except as limited under § 99.12, a 
parent or eligible student must be given 
the opportunity to inspect and review 
the student’s education records. This 
provision applies to — 



(1) Any educational agency or 
institution; and 

(2) Any State educational agency 
(SEA) and its components. 

(i) For the purposes of subpart B of 
this part, an SEA and its components 
constitute an educational agency or 
institution. 

(ii) An SEA and its components are 
subject to subpart B of this part if the 
SEA maintains education records on 
students who are or have been in 
attendance at any school of an 
educational agency or institution subject 
to the Act and this part. 

(b) The educational agency or 
institution, or SEA or its component, 
shall comply with a request for access 
to records within a reasonable period of 
time, but not more than 45 days after it 
has received the request. 

(d) If circumstances effectively 
prevent the parent or eligible student 
from exercising the right to inspect and 
review the student’s education records, 
the educational agency or institution, or 
SEA or its component, shall — 

(1) Provide the parent or eligible 
student with a copy of the records 
requested; or 

(2) Make other arrangements for the 
parent or eligible student to inspect and 
review the requested records. 
***** 

(Authority: 20 U.S.C. 1232g(a)(l) (A) and (B)) 

§99.12 [Amended] 

8. Section 99.12 is amended by 
removing in paragraph (a) the commas 
after “inspect” and after “review” and 
by adding after the word “inspect” the 
word “and” and by revising the 
authority citation to read as follows: 

(Authority: 20 U.S.C. 1232g(a)(l) (A), (B), (C), 
and (D)) 

§99.20 [Amended] 

9. Section 99.20 is amended by 
removing in paragraph (a) the words “or 
other rights”. 

§99.21 [Amended] 

10. Section 99.21 is amended by 
removing in paragraphs (a), (b)(1), 
introductory text, and (b)(2) the words 
“or other”. 

11. Section 99.31 is amended by 
redesignating paragraph (a)(6)(iii) as 
paragraph (a)(6)(iv), by adding a new 
paragraph (a)(6)(iii) and by revising 
paragraphs (a)(5)(i) and (a)(9) and the 
authority citation to read as follows: 

§ 99.31 Under what conditions is prior 
consent not required to disclose 
information? 

(a) * * * . 



(5) (i) The disclosure is to State and 
local officials or authorities to whom 
this information is specifically — 

(A) Allowed to be reported or 
disclosed pursuant to State statute 
adopted before November 19, 1974, if 
the allowed reporting or disclosure 
concerns the juvenile justice system and 
the system’s ability to effectively serve 
the student whose records are released; 
or 

(B) Allowed to be reported or 
disclosed pursuant to State statute 
adopted after November 19, 1974, 
subject to the requirements of § 99.38. 

( 6 ) * * * 

(iii) If this Office determines that a 
third party outside the educational 
agency or institution to whom 
information is disclosed under this 
paragraph (a)(6) violates paragraph 

(a) (6)(ii)(B) of this section, the 
educational agency or institution may 
not allow that third party access to 
personally identifiable information from 
education records for at least five years. 

(9)(i) The disclosure is to comply with 
a judicial order or lawfully issued 
subpoena. 

(ii) The educational agency or 
institution may disclose information 
under paragraph (a)(9)(i) of this section 
only if the agency or institution makes 
a reasonable effort to notify the parent 
or eligible student of the order or 
subpoena in advance of compliance, so 
that the parent or eligible student may 
seek protective action, unless the 
disclosure is in compliance with — 

(A) A Federal grand jury subpoena 
and the court has ordered that the 
existence or the contents of the 
subpoena or the information furnished 
in response to the subpoena not be 
disclosed; or 

(B) Any other subpoena issued for a 
law enforcement purpose and the court 
or other issuing agency has ordered that 
the existence or the contents of the 
subpoena or the information furnished 
in response to the subpoena not be 
disclosed. 

(iii) If the educational agency or 
institution initiates legal action against 
a parent or student and has complied 
with paragraph (a)(9)(ii) of this section, 
it may disclose the student’s education 
records that are relevant to the action to 
the court without a court order or 
subpoena. 

***** 

(Authority: 20 U.S.C. 1232g(a)(5)(A), (b)(1), 

(b) (2), (b)(4)(B), and (f)). 

12. Section 99.32 is amended by 
removing the word “or” following 
paragraph (d)(3), replacing the period at 
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the end of paragraph (d)(4) with a 
semicolon and adding the word “or” 
after the semicolon, adding a new 
paragraph (d)(5), and revising the 
authority citation to read as follows: 

§99.32 What recordkeeping requirements 
exist concerning requests and disclosures? 

***** 

(d) * * * 

(5) A party seeking or receiving the 
records as directed by a Federal grand 
jury or other law enforcement subpoena 
and the issuing court or other issuing 
agency has ordered that the existence or 
the contents of the subpoena or the 
information furnished in response to the 
subpoena not be disclosed. 

(Approved by the Office of Management and 
Budget under control number 1880-0508) 
(Authority: 20 U.S.C. 1232g(b)(l) and 

(b) (4)(A)) 

13. Section 99.33 is amended by 
revising paragraphs (c) and (d) and by 
adding a new paragraph (e) to read as 
follows: 

§ 99.33 What limitations apply to the 
redisclosure of information? 

***** 

(c) Paragraph (a) of this section does 
not apply to disclosures made pursuant 
to court orders or lawfully issued 
subpoenas under § 99.31(a)(9), to 
disclosures of directory information 
under § 99. 3 1 (a)(l 1 ), or to disclosures to 
a parent or student under § 99.31 (a)(l 2). 

(d) Except for disclosures under 
§ 99.31(a) (9), (11), and (12), an 
educational agency or institution shall 
inform a party to whom disclosure is 
made of the requirements of this 
section. 

(e) If this Office determines that a 
third party improperly rediscloses 
personally identifiable information from 
education records in violation of 

§ 99.33(a) of this section, the 
educational agency or institution may 
not allow that third party access to 
personally identifiable information from 
education records for at least five years. 

§99.34 [Amended] 

14. Section 99.34(a)(l)(ii) is amended 
by removing the word “policy” and 
adding, in its place, the words “annual 
notification”. 

15. Section 99.36 is amended by 
revising paragraph (b), adding paragraph 

(c) and revising the authority citation to 
read as follows: 

§ 99.36 What conditions apply to 
disclosure of information in health and 
safety emergencies? 

***** 

(b) Nothing in this Act or this part 
shall prevent an educational agency or 
institution from — 



(1) Including in the education records 
of a student appropriate information 
concerning disciplinary action taken 
against the student for conduct that 
posed a significant risk to the safety or 
well-being of that student, other 
students, or other members of the school 
community; 

(2) Disclosing appropriate information 
maintained under paragraph (b)(1) of 
this section to teachers and school 
officials within the agency or institution 
who the agency or institution has 
determined have legitimate educational 
interests in the behavior of the student; 
or 

(3) Disclosing appropriate information 
maintained under paragraph (b)(1) of 
this section to teachers and school 
officials in other schools who have been 
determined to have legitimate 
educational interests in the behavior of 
the student. 

(c) Paragraphs (a) and (b) of this 
section will be strictly construed. 
(Authority: 20 U.S.C. 1232g (b)(l)(I) and (h)) 

16. A new §99.38 is added to subpart 
D to read as follows: 

§ 99.38 What conditions apply to 
disclosure of information as permitted by 
State statute adopted after November 19, 
1974 concerning the juvenile justice 
system? 

(a) If reporting or disclosure allowed 
by State statute concerns the juvenile 
justice system and the system’s ability 
to effectively serve, prior to 
adjudication, the student whose records 
are released, an educational agency or 
institution may disclose education 
records under § 99. 31 (a)(5)(i)(B). 

(b) The officials and authorities to 
whom the records are disclosed shall 
certify in writing to the educational 
agency or institution that the 
information will not be disclosed to any 
other party, except as provided under 
State law, without the prior written 
consent of the parent of the student. 
(Authority: 20 U.S.C. 1232g(b)(l)(J)) 

§99.63 [Amended] 

17. Section 99.63 is amended by 
removing the word “person” and 
adding, in its place, the words “parent 
or eligible student”. 

Appendix 

(Note: This appendix will not be codified in 
the Code of Federal Regulations.) 

Model Notification of Rights Under FERPA 
for Elementary and Secondary Institutions 

The Family Educational Rights and Privacy 
Act (FERPA) affords parents and students 
over 18 years of age (“eligible students”) 
certain rights with respect to the student’s 
education records. They are: 



(1) The right to inspect and review the 
student’s education records within 45 days of 
the day the District receives a request for 
access. 

Parents or eligible students should submit 
to the school principal [or appropriate school 
official] a written request that identifies the 
record(s) they wish to inspect. The principal 
will make arrangements for access and notify 
the parent or eligible student of the time and 
place where the records may be inspected. 

(2) The right to request the amendment of 
the student’s education records that the 
parent or eligible student believes are 
inaccurate or misleading. 

Parents or eligible students may ask Alpha 
School District to amend a record that they 
believe is inaccurate or misleading. They 
should write the school principal, clearly 
identify the part of the record they want 
changed, and specify why it is inaccurate or 
misleading. 

If the District decides not to amend the 
record as requested by the parent or eligible 
student, the District will notify the parent or 
eligible student of the decision and advise 
them of their right to a hearing regarding the 
request for amendment. Additional 
information regarding the hearing procedures 
will be provided to the parent or eligible 
student when notified of the right to a 
hearing. 

(3) The right to consent to disclosures of 
personally identifiable information contained 
in the student’s education records, except to 
the extent that FERPA authorizes disclosure 
without consent. 

One exception which permits disclosure 
without consent is disclosure to school 
officials with legitimate educational interests. 
A school official is a person employed by the 
District as an administrator, supervisor, 
instructor, or support staff member 
(including health or medical staff and law 
enforcement unit personnel); a person 
serving on the School Board; a person or 
company with whom the District has 
contracted to perform a special task (such as 
an attorney, auditor, medical consultant, or 
therapist); or a parent or student serving on 
an official committee, such as a disciplinary 
or grievance committee, or assisting another 
school official in performing his or her tasks. 

A school official has a legitimate 
educational interest if the official needs to 
review an education record in order to fulfill 
his or her professional responsibility. 

(Optional] Upon request, the District 
discloses education records without consent 
to officials of another school district in which 
a student seeks or intends to enroll. [Note: 
FERPA requires a school district to make a 
reasonable attempt to notify the student of 
the records request unless it states in its 
annual notification that it intends to forward 
records on request.] 

(4) The right to file a complaint with the 
U.S. Department of Education concerning 
alleged failures by the District to comply 
with the requirements of FERPA. The name 
and address of the Office that administers 
FERPA is: 

Family Policy Compliance Office, U.S. 

Department of Education, 400 Maryland 

Avenue, SW, Washington, DC 20202-4605 
[Note: In addition, a school may want to 
include its directory information public 
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DEPARTMENT OF EDUCATION 

34 CFR Part 98 

RIN 1880-AA66 

Protection of Pupil Rights 

AGENCY: Department of Education. 
ACTION: Notice of proposed rulemaking. 

SUMMARY: The Secretary proposes 
regulations to implement the Pupil 
Protection Rights Amendments of 1994 
(PPRA) to the Protection of Pupil Rights 
provision contained in the General 
Education Provisions Act (GEPA). PPRA 
was amended in the Goals 2000: 

Educate America Act (Pub. L. 103-227). 
The proposed regulations rename and 
revise the current regulations (34 CFR 
part 98 “Student Rights in Research, 
Experimental Activities, and Testing”) 
for the Protection of Pupil Rights to 
implement these statutory changes and 
to make other changes that are necessary 
for proper program operation. 

DATES: Comments must be received on 
or before October 27, 1995. 

ADDRESSES: All comments concerning 
these proposed regulations should be 
addressed to LeRoy Rooker, U.S. 
Department of Education, 600 
Independence Avenue SW., room 1366, 
Washington, DC 20202-4605. 

Comments may also be sent through 
Internet to “PPRA — 
Comments@ed.gov.” 

A copy of any comments that concern 
information collection requirements 
should also be sent to the Office of 
Management and Budget at the address 
listed in the Paperwork Reduction Act 
of 1980 section of this preamble. 

FOR FURTHER INFORMATION CONTACT: 

Ellen Campbell, U.S. Department of 
Education, 600 Independence Avenue, 
SW., room 1366, Washington, DC 
20202-4605. Telephone: (202) 260- 
3887. Individuals who use a 
telecommunications device for the deaf 
(TDD) may call the Federal Information 
Relay Service (FIRS) at 1-800-877-8339 
between 8 a.m. and 8 p.m., Eastern time, 
Monday through Friday. 

SUPPLEMENTARY INFORMATION: These 
proposed regulations have been 
reviewed and revised in accordance 
with the Department’s “Principles for 
Regulating,” which were developed to 
ensure that the Department regulates in 
the most flexible, most equitable, and 
least burdensome way possible. These 
principles advance the regulatory 
reinvention and customer service 
objectives of the Administration’s 
National Performance Review II and are 
essential to an effective partnership 
with states and localities. The Secretary 



proposes these regulations because he 
believes they are necessary to 
implement the law and give the greatest 
flexibility to local governments and 
schools. In addition, the regulations 
minimize burden while retaining 
parents’ and students’ rights. 

The Secretary interprets the 
Protection of Pupil Rights provision, as 
amended, contained in section 445 of 
the General Education Provisions Act 
(GEPA) to provide parents with the right 
to have access to surveys, analyses, or 
evaluations (surveys) administered by a 
State educational agency (SEA), local 
educational agency (LEA), or other 
recipient that asks a student to reveal 
information concerning the areas 
specified in section 445(b) of GEPA. In 
addition, parents or the student, if a 
student is an adult or an emancipated 
minor, must consent before a student is 
required to submit to a survey that asks 
a student to reveal information 
concerning these areas. Finally, parents 
or the student, if a student is an adult 
or an emancipated minor, must be 
notified of these rights and may file a 
complaint for alleged violations of these 
rights. 

Summary of Major Provisions 

The following is a summary of the 
regulatory provisions the Secretary 
proposes as necessary to implement the 
statute, such as interpretations of 
statutory text or standards and 
procedures for the operation of the 
program. The summary does not address 
provisions that merely restate statutory 
language. The Secretary is not 
authorized to change statutory 
requirements. Commenters are 
requested to direct their comments to 
the regulatory provisions that would 
implement the statute. 

Section 98.1 Applicable Program 

The Protection of Pupil Rights 
provision contained in GEPA applies to 
any program that is an “applicable 
program” under section 400(c)(1) of 
GEPA. Under this section the term 
“applicable program” means any 
program for which the Secretary or the 
Department has administrative 
responsibility as provided by law or by 
delegation of authority pursuant to law. 
The term includes each program for 
which the Secretary or the Department 
has administrative responsibility under 
the Department of Education 
Organization Act (DEOA) or under 
Federal law effective after May 4, 1980. 

Section 98.2 Purpose 

The Secretary interprets section 445 
of GEPA to provide four general rights: 

•' (1) Parental right of access to certain 



surveys and the instructional material 
used in connection with these surveys 
of a student; (2) parental or student right 
to consent before a student is required 
to submit to certain surveys; (3) parental 
or student right to file a complaint for 
alleged violations of their rights under 
the law; and (4) parental or student right 
to receive effective notice of these 
rights. The Secretary would implement 
each of these rights in the proposed 
regulations. 

Section 98.3 Definitions 

The Secretary proposes to define 
“recipient” to include (1) a contractor 
who receives financial assistance 
directly from the Department to carry 
out the project and (2) the Department. 
This definition clarifies that any survey 
that the Department directly contracts 
for or carries out itself would be subject 
to these regulations. 

The Secretary proposes not to define 
the term “survey” because he believes 
the term is self-explanatory. The 
Secretary would welcome comment on 
whether the terms “survey, analysis, or 
evaluation” as used in section 445 of 
GEPA should be defined in regulations. 

Sections 98.10, 98.20 Access and 
Consent 

Section 445(a) of GEPA provides for 
the parental right of access to 
instructional materials that will be used 
in connection with any survey as part of 
any applicable program. 

Section 445(b) of GEPA provides for 
the parent’s, in the case of an 
unemancipated minor, and student’s, if 
the student is an adult or emancipated 
minor, right of consent to submit to a 
survey that reveals information 
concerning one or more of the areas 
specified in the statute (also listed in 
§ 98.4(a)(2)). 

The Secretary interprets the statutory 
provisions on access and consent to be 
read together; this interpretation would 
require an SEA, LEA, or other recipient 
of program funds from the Department 
of Education to make available for 
inspection by a parent or guardian only 
those surveys (and instructional 
material in connection with a survey) 
concerning one or more of the areas 
listed in section 445(b) of GEPA. 
Because, unlike the Family Educational 
Rights and Privacy Act (FERPA), this 
statute makes no specific reference 
applying the access and consent 
provisions to post-secondary 
institutions and the legislative history 
supports only applying these provisions 
to elementary and secondary school 
students, these proposed regulations 
will only apply to surveys administered 
in elementary and secondary schools. 
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— Access provision: The Secretary 
would implement the access 
provision by requiring that an SEA, 
LEA, or other recipient that uses any 
type of program funds received from 
the Department, to develop or 
implement a survey must make 
available for inspection by a parent or 
guardian of a student a survey, and 
the instructional materials used in 
connection with the survey, if the 
survey (1) asks the student to reveal 
information concerning one or more 
of the areas listed in section 445(b) of 
GEPA; and (2) is administered in an 
elementary or secondary school. 

— Compliance with a request for access: 
An SEA, LEA, or other recipient 
would be required to comply with a 
request to inspect a survey (and the 
instructional materials used in 
connection with the survey) without 
unnecessary delay and in no case 
more than 45 days after it has 
received the request. This 
requirement is consistent with 
FERPA. Also, the Secretary believes 
this requirement is a reasonable way 
to ensure a prompt response to a 
parent’s request for access to these 
materials while not requiring an SEA, 
LEA, or other recipient to provide 
immediate access. 

An SEA, LEA, or other recipient 
would not be required to provide 
parents with their own copy of a survey 
(and the instructional material used in 
connection with the survey). The 
Secretary believes that such a 
requirement would be unduly 
burdensome. The Secretary notes, 
however, that an SEA, LEA, or other 
recipient may wish to provide a copy of 
a survey in order to accommodate 
parents with disabilities. 

— Destruction of material: An SEA, LEA, 
or other recipient would not be 
permitted to destroy any survey or the 
instructional material used in 
connection with the survey, if there is 
an outstanding request to inspect the 
material under § 94.10 of the 
regulations. The Secretary believes 
this provision is necessary to ensure 
that a parent’s request for access is not 
frustrated. 

— Consent provision: The Secretary 
would implement the consent 
provision by requiring an SEA, LEA, 
or other recipient to obtain the prior 
consent of the parent or guardian, or 
student, as appropriate, before a 
student is required to submit to the 
survey if the SEA, LEA, or other 
recipient (1) uses any type of program 
funds, received from the Department, 
to develop or implement a survey; (2) 
the survey is administered in an 




elementary or secondary school; and 
(3) requires a student to submit to a 
survey that asks the student to reveal 
information concerning one or more 
of the areas listed in section 445(b) of 
GEPA. The Secretary has not 
interpreted “required” as used in 
section 445(b) of GEPA. By not 
interpreting the word “required”, the 
Secretary will not be imposing a 
single rule to address a myriad of 
situations. Recipients will make 
initial judgments in individual cases 
as to whether a survey is or has been 
“required” in the administration of 
their activities. In the event a 
complaint is filed with the 
Department, the Department will 
determine on a case-by-case basis in 
light of all the circumstances whether 
a student has been required to submit 
to a survey. 

Section 445(b) of GEPA provides that 
if a student is an unemancipated minor, 
a parent or guardian of a student 
provides the consent. If a student is an 
adult or emancipated minor, the student 
provides the consent. An adult would 
be defined as an individual who has 
attained 18 years of age. An 
emancipated minor would be defined 
according to the definition under State 
law. 

— Obtaining consent: To meet the 
requirements of prior consent an SEA, 
LEA, or other recipient must provide 
an opportunity for the student or 
parent or guardian of a student to 
review a general description or 
summary of the type of information 
found in section 445(b) that is 
included in the survey and to provide 
information to the parent or guardian 
on the right to inspect the materials 
before the student submits to the 
survey. Rather than prescribing in 
regulations a standard form of written 
consent for parents or guardians, the 
Secretary proposes to allow an SEA, 
LEA, or other recipient the flexibility 
to develop its own type of written 
consent. To provide guidance to 
SEAs, LEAs, and other recipients, the 
Department intends to develop a 
model consent form. 

Section 98.30 LEA Notification 

Section 445(c) of GEPA provides that 
educational agencies and institutions 
shall give parents and students effective 
notice of their rights. The Secretary 
would implement this provision by 
requiring each LEA to give effective 
notice to parents of students in 
attendance, and students currently in 
attendance, at the LEA of their rights 
under the regulations. The notice would 
state, at a minimum, that parents and 

T33 



students have the four rights listed in 
§ 98.2. An LEA would have the option 
to include more information in the 
notice. With respect to frequency, an 
annual notification, for example, would 
constitute an effective notice. 

Section 98.40 Family Policy 
Compliance Office and the Office of 
Administrative Law fudges Functions 

Section 445(e) of GEPA requires the 
Secretary to establish or designate an 
office and review board within the 
Department to investigate, process, 
review, and adjudicate violations of the 
rights established under this section. 
The Secretary would designate the 
Family Policy Compliance Office 
(Office) to investigate, process, and 
review complaints of violations under 
the regulations and to provide technical 
assistance to ensure compliance with 
the regulations. The Secretary would 
designate the Office of Administrative 
Law Judges as having jurisdiction over 
proceedings to recover, withhold, and 
terminate funds and to conduct hearings 
to compel compliance through cease 
and desist orders. 

Section 98.41 Conflict With State or 
Local Laws 

If an SEA or LEA determines that it 
cannot comply with the requirements of 
these regulations due to a conflict with 
State or local laws, it would be required 
to notify the Office within 45 days, 
giving the text and citation of the 
conflicting law. This provision is 
consistent with the Family Educational 
Rights and Privacy regulations (34 CFR 
99.61). The Secretary believes that, to 
the extent possible, these proposed 
regulations should parallel the 
regulations implementing the Federal 
Educational Rights and Privacy Act 
(FERPA) because both the protection of 
pupil rights legislation and FERPA were 
originally introduced together with a 
common purpose and, therefore, should 
be administered in a similar fashion. 

Section 98.42 SEA or LEA Required 
Reports 

Under the proposed regulations the 
Office may require an SEA or LEA to 
submit reports containing information 
necessary to resolve complaints under 
this part, including information 
regarding the source of funding for the 
survey, and to ensure that SEAs, LEAs, 
or other recipients are complying with 
the statute. This requirement is in the 
current regulations (34 CFR 98.6). 

Sections 98.43, 98.44 , 98.45 
Complaint Procedures 

The statute does not specify any 
procedures for filing or processing a 
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complaint. The regulations would allow 
a parent or student, as appropriate, to 
file a written complaint with the Office 
regarding an alleged violation under this 
part. This requirement is in the current 
regulations (34 CFR 98.7(a)). 

The proposed regulations would 
clarify when a parent and student have 
a right to file a complaint. Also, the 
proposed regulations would require that 
a complaint contain specific allegations 
of fact giving reasonable cause to believe 
that a violation of this part has occurred. 
The Office would investigate each 
timely complaint to determine whether 
an SEA, LEA, or other recipient has 
failed to comply with the proposed 
regulations. These requirements are in 
34 CFR 98.7(a) and (b), respectively, of 
the current regulations. 

The proposed regulations clarify 
when a complaint would be timely and 
when the Office may extend the time 
limit. These provisions are consistent 
with the requirements in 34 CFR 
99.64(c) and (d) of the FERPA 
regulations. Again, the Secretary 
believes that for the reasons already 
discussed, and to the extent possible, 
the proposed regulations should be 
consistent with the FERPA regulations. 

— Notice of complaint issued by the 
Office: The Office notifies the 
complainant and the SEA, LEA, or other 
recipient in writing if it initiates an 
investigation of a complaint and notifies 
the complainant if it does not initiate an 
investigation of a complaint. The 
required content of the notice to the 
SEA, LEA, or other recipient is 
consistent with 34 CFR 98.8(a) and (b) 
of the current regulations. The Secretary 
believes this notification is necessary to 
keep the complainant properly informed 
of the status of his or her complaint. 

Sections 98.46, 98.47 Enforcement 
Process 

The statute does not prescribe any 
enforcement procedures except for the 
establishment or designation of an office 
and review board within the 
Department of Education to investigate, 
process, review and adjudicate 
violations of the rights established by 
section 445 of GEPA. Under the 
proposed regulations, the Office would 
review a complaint and response and 
may permit the parties to submit further 
written or oral arguments or 
information. Following its investigation, 
the Office would provide to the 
complainant and the SEA, LEA, or other 
recipient written notice of its findings 
and the basis for its findings. If the 
Office found that the SEA, LEA, or other 
recipient had not complied with these 
regulations, the notice would (1) 
include a statement of the specific steps 



that the SEA, LEA, or other recipient 
must take to comply; and (2) provide a 
reasonable period of time, given all the 
circumstances of the case, during which 
the SEA, LEA, or other recipient may 
comply voluntarily. This procedure is 
consistent with that in 34 CFR 98.9 of 
the current regulations. 

If an SEA, LEA, or other recipient 
other than a contractor does not 
voluntarily comply with the proposed 
regulations, the Office may, in 
accordance with part D of GEPA, (1) 
withhold, recover, or terminate funds 
under 34 CFR 81.3; or (2) issue a 
complaint to compel compliance 
through a cease-and-desist order under 
34 CFR 81.3. This is consistent with 34 
CFR 98.10(a)(1) of the current 
regulations. 

If a contractor does not voluntarily 
comply with the proposed regulations, 
the Office may direct the contracting 
officer to take an appropriate action 
authorized under the Federal 
Acquisition Regulation, including either 
(1) issuing a notice to suspend 
operations under 48 CFR 12.5; or (2) 
issuing a notice to terminate for default, 
either in whole or in part under 48 CFR 
49.102. 

If, after an investigation, the Secretary 
finds that an SEA, LEA, or other 
recipient has complied voluntarily with 
these regulations, the Secretary provides 
the complainant and the SEA or LEA 
written notice of the decision and the 
basis for the decision. These 
enforcement provisions are consistent 
with 34 CFR 98.10(b) of the current 
regulations. 

Executive Order 12866 

1 . Assessment of Costs and Benefits 

These proposed regulations have been 
reviewed in accordance with Executive 
Order 12866. Under the terms of the 
order the Secretary has assessed the 
potential costs and benefits of this 
regulatory action. 

The potential costs associated with 
the proposed regulations are those 
resulting from statutory requirements 
and those determined by the Secretary 
to be necessary to administer this 
program effectively and efficiently. 
Burdens specifically associated with 
information collection requirements, if 
any, are identified and explained 
elsewhere in this preamble under the 
heading Paperwork Reduction Act of 
1980. 

In assessing the potential costs and 
benefits — both quantitative and 
qualitative — of these proposed 
regulations, the Secretary has 
determined that the benefits of the 
proposed regulations justify the costs. 



To assist the Department in 
complying with the specific 
requirements of Executive Order 12866, 
the Secretary invites comment on 
whether there may be further 
opportunities to reduce any potential 
costs or increase potential benefits 
resulting from these proposed 
regulations without impeding the 
effective and efficient administration of 
the program. 

2. Clarity of the Regulations 

Executive Order 12866 requires each 
agency to write regulations that are easy 
to understand. 

The Secretary invites comments on 
how to make these proposed regulations 
easier to understand, including answers 
to questions such as the following: (1) 
Are the requirements in the proposed 
regulations clearly stated? (2) Do the 
regulations contain technical terms or 
other wording that interferes with their 
clarity? (3) Does the format of the 
regulations (grouping and order of 
sections, use of headings, paragraphing 
etc.) aid or reduce their clarity? Would 
the regulations be easier to understand 
if they were divided into more (but 
shorter) sections? (A “section” is 
preceded by the symbol “§ ” and a 
numbered heading; for example, § 98,1 
To which programs do these regulations 
apply?) (4) Is the description of the 
regulations in the “Supplementary 
Information” section of this preamble 
helpful in understanding the 
regulations? How could this description 
be more helpful in making the 
regulations easier to understand? (5) 
What else could the Department do to 
make the regulations easier to 
understand? 

A copy of any comments that concern 
how the Department could make these 
proposed regulations easier to 
understand should be sent to Stanley M. 
Cohen, Regulations Quality Officer, U.S. 
Department of Education, 600 
Independence Avenue, SW. (room 5121, 
FOB-10B), Washington, DC 20202- 
2241. 

Regulatory Flexibility Act Certification 

The Secretary certifies that these 
proposed regulations would not have a 
significant economic impact on a 
substantial number of small entities. 

The small entities that would be 
affected by these proposed regulations 
are small LEAs receiving Federal funds 
from the Department. However, the 
regulations would not have a significant 
economic impact on the small LEAs 
affected because the regulations would 
not impose excessive regulatory burdens 
or require unnecessary Federal 
supervision. The regulations would 
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impose minimal requirements to ensure 
that LEAs comply with the pupil 
protection requirements in GEPA. 

Paperwork Reduction Act of 1980 

Section 98.30 contains information 
collection requirements. As required by 
the Paperwork Reduction Act of 1980, 
the Department of Education will 
submit a copy of this section to the 
Office of Management and Budget 
(OMB) for its review. (44 U.S.C. 3504(h)) 

SEAs, LEAs, and other recipients may 
be affected by these regulations. The 
Department needs and uses the 
information to ensure compliance with 
requirements in the Pupil Protection 
Rights in GEPA. Annual public 
reporting burden for this collection of 
information is estimated to be .25 hours 
per response for 15,713 respondents, 
including the time for reviewing 
instructions, searching existing data 
sources, gathering and maintaining the 
data needed, and completing and 
reviewing the collection of information. 

Organizations and individuals 
desiring to submit comments on the 
information collection requirements 
should direct them to the Office of 
Information and Regulatory Affairs, 
OMB, room 3002, New Executive Office 
Building, Washington, DC 20503; 
Attention: Daniel J. Chenok. 

Invitation to Comment 

Interested persons are invited to 
submit comments and recommendations 
regarding these proposed regulations. 
This section highlights those issues 
already discussed in the preamble on 
which the Secretary would particularly 
like comment. 

The Secretary has attempted to 
balance a number of interests by 
interpreting “applicable program” 
narrowly and applying these regulations 
only to surveys that are developed or 
implemented under Department 
programs. The Secretary believes that 
this interpretation balances the rights of 
parents and students under the statute, 
with the interests of local governments 
and schools in minimal administrative 
burdens. The Secretary requests 
comments on this interpretation. The 
Secretary is trying to minimize the role 
of the Federal government in 
implementing the statute. 

The Secretary specifically requests 
comments from school officials 
regarding the practicality of a narrow 
interpretation. As proposed, if asked, an 
SEA or LEA would have to be able to 
identify which funds it used to develop, 
or otherwise implement, a survey. On 
the other hand, if the Secretary 
interpreted “applicable program” 
broadly, the regulations would apply to 



any survey given by a school that 
receives money from the Department, 
and an identification of whether 
Department money was used in 
developing or implementing the survey 
would be unnecessary. The Secretary 
welcomes comments on whether school 
officials believe the broader 
interpretation of “applicable program” 
would be less burdensome. 

The Secretary also requests comments 
on whether it is clear that these 
proposed regulations only apply to 
surveys that are developed, purchased, 
implemented, or otherwise funded 
under Department programs covered by 
section 445 of GEPA. The Secretary also 
requests comments on whether the 
provisions regarding access and consent 
rights, §§98.10 and 98.20 respectively, 
provide adequate guidance. 

As previously stated in the preamble 
the Secretary would like comments on 
whether the regulations should include 
a definition of “survey” (see discussion 
of §98.3 Definitions) and “required” 

(see discussion of §§98.10, 98.20 Access 
and consent: Obtaining consent). 

Finally, as already discussed, the 
regulations interpret the statute to apply 
to surveys administered in elementary 
or secondary schools because the statute 
specifically provides protections under 
this law to “students.” The Secretary 
requests specific comments on whether 
the statutory provisions should be 
interpreted to include surveys 
administered in settings outside of 
schools, such as Department-sponsored 
household-based surveys, conducted 
either by telephone or in person. 

All comments submitted in response 
to these proposed regulations will be 
available for public inspection, during 
and after the comment period, in room 
1366, FOB-10, 600 Independence 
Avenue SW., Washington, DC, between 
the hours of 8:30 a.m. and 4 p.m., 
Monday through Friday of each week 
except Federal holidays. 

Assessment of Educational Impact 

The Secretary particularly requests 
comments on whether the proposed 
regulations in this document would 
require transmission of information that 
is being gathered by or is available from 
any other agency or authority of the 
United States. 

List of Subjects in 34 CFR Part 98 

Administrative practice and 
procedure, Education, Educational 
research, Privacy, Reporting and 
recordkeeping requirements, Schools, 
and Students. 
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Dated: August 21, 1995. 

Richard W. Riley, 

Secretary of Education . 

(Catalog of Federal Domestic Assistance 
Number does not apply.) 

The Secretary proposes to amend title 
34 of the Code of Federal Regulations by 
revising part 98 to read as follows: 

PART 98 — PROTECTION OF PUPIL 
RIGHTS 

Subpart A — General 

Sec. 

98.1 To which programs do these 
regulations apply? 

98.2 What is the purpose of these 
regulations? 

98.3 What definitions apply to these 
regulations? 

Subpart B — Access 

98.10 What are a parent’s rights of access to 
a survey? 

Subpart C — Consent 

98.20 In what circumstances must an SEA, 
LEA, or other recipient obtain consent 
before requiring a student to submit to a 
survey? 

Subpart D — Notification 

98.30 What must an LEA include in its 
annual notification? 

Subpart E — Enforcement 

98.40 What are the functions of the Family 
Policy Compliance Office (Office) and 
the Office of Administrative Law Judges? 

98.41 What are an SEA’s and LEA’s 
responsibilities in the case of a conflict 
with State or local laws? 

98.42 What information must an SEA, LEA, 
or other recipient submit to the Office? 

98.43 Where are complaints filed? 

98.44 What is the complaint procedure? 

98.45 What is the content of the notice of 
complaint issued by the Office? 

98.46 What are the responsibilities of the 
Office in the enforcement process? 

98.47 How does the Office enforce 
decisions? 

Authority: 20 U.S.C. 1232h, unless 
otherwise noted. 

Subpart A—General 

§ 98.1 To which programs do these 
regulations apply? 

This part applies to any applicable 
program, that is, any program for which 
the Secretary or the Department has 
administrative responsibility as 
provided by law or by delegation of 
authority pursuant to law. 

(Authority: 20 U.S.C. 1232h) 

§ 98.2 What is the purpose of these 
regulations? 

Parents and students have the 
following rights under this part: 

(a) Parental right to have access to 
certain surveys, analyses, or evaluations 
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(surveys), and the instructional 
materials used in connection with these 
surveys of a student. 

(b) Parental or student right to consent 
before the student is required to submit 
to certain surveys. 

(c) Parental or student right to file a 
complaint for alleged violations of the 
rights in paragraphs (a), (b), and (d) of 
this section. 

(d) Parental or student right to receive 
effective notice of the rights under 
paragraphs (a), (b), and (c) of this 
section. 

(Authority: 20 U.S.C. 1232h) 

§ 98.3 What definitions apply to these 
regulations? 

(a) The following terms used in this 
part are defined in 34 CFR 77.1: 
Department 

Elementary school 
Grantee 

Local educational agency (LEA) 

Secondary school 

Secretary 

State educational agency (SEA). 

(b) Other definitions. The following 
definitions also apply to this part: 

Adult means an individual who has 
attained 18 years of age. 

Emancipated minor means a person 
under 18 years of age who would be 
considered emancipated according to 
state law. 

Recipient, for the purposes of this 
part, means a grantee, subgrantee, or 
contractor that receives financial 
assistance directly from the Department 
to carry out a project and includes the 
Department. 

(Authority: 20 U.S.C. 1 23 2h) 

Subpart B— Access 

§ 98.10 What are a parent’s rights of 
access to a survey? 

(a) An SEA, LEA, or other recipient 
that receives funds from the Department 
to develop or implement a survey shall 
make available for inspection by a 
parent or guardian of a student the 
survey, and the instructional materials 
used in connection with the survey, if 
the survey — 

(1) Is administered in an elementary 
or a secondary school; and 

(2) Asks the student to reveal 
information concerning one or more of 
the following areas: 

(i) Political affiliations. 

(ii) Mental and psychological 
problems potentially embarrassing to 
the student or his or her family. 

(iii) Sex behavior and attitudes. 

(iv) Illegal, anti-social, self- 
incriminating, and demeaning behavior. 

(v) Critical appraisals of other 
individuals with whom the student has 
close family relationships. 



(vi) Legally recognized privileged or 
analogous relationships, such as those 
of lawyers, physicians, and ministers. 

(vii) Income, other than that required 
by law to determine eligibility for 
participation in a program or for 
receiving financial assistance under a 
program. 

(b) (1) An SEA, LEA, or other recipient 
shall comply with a parent’s request to 
inspect a survey (and the instructional 
material used in connection with the 
survey) under paragraph (a) of this 
section without unnecessary delay and 
in no case more than 45 days after the 
recipient receives the request. 

(2) An SEA, LEA, or other recipient is 
not required to give a personal copy of 
the survey, and the instructional 
materials, to a parent who requests to 
inspect a survey under paragraph (a) of 
this section. 

(c) An SEA, LEA, or other recipient 
may not destroy any survey, or any 
instructional material used in 
connection with the survey, if there is 
an outstanding request by a parent to 
inspect the material under this section. 

(d) An SEA, LEA, or other recipient 
shall make the survey available for 
inspection under paragraph (a) of this 
section even if a student is not required 
to submit to the survey under § 98.20. 

(Authority: 20 U.S.C. 1232h(a)) 

Subpart C— Consent 

§ 98.20 In what circumstances must an 
SEA, LEA, or other recipient obtain consent 
before requiring a student to submit to a 
survey? 

(a) An SEA, LEA, or other recipient 
shall obtain the prior consent of the 
parent or guardian of a student, or the 
student, if appropriate under paragraph 

(b) of this section, before the student is 
required to submit to the survey if the 
SEA, LEA, or other recipient — 

(1) Uses funds, received from the 
Department, to develop or implement 
the survey; 

(2) Administers the survey in an 
elementary or secondary school; 

(3) Requires the student to submit to 
the survey; and 

(4) Asks the student in the survey to 
reveal information concerning one or 
more of the areas listed in § 98.10(a)(2). 

(b) (1) If a student is an 
unemancipated minor, the SEA, LEA, or 
other recipient must obtain the consent 
required in paragraph (a) of this section, 
in writing, from the parent or guardian 
of the student. 

(2) If a student is an adult or 
emancipated minor, the SEA, LEA, or 
other recipient must obtain the consent 
required in paragraph (a) of this section 
from the student. 



(c) To meet the requirements of prior 
consent the SEA, LEA, or other recipient 
must provide — 

(1) An opportunity for the student or 
parent or guardian of a student to 
review a general description or 
summary of the type of information 
found in § 98. 10(a)(2). that is included in 
the survey; and 

(2) Information to the parent or 
guardian on the right to inspect these 
materials before the student submits to 
the survey. 

(Authority: 20 U.S.C. 1232h(b)) 

Subpart D— Notification 

§ 98.30 What must an LEA include in its 
notification? 

(a) Each LEA shall give effective 
notice to parents of students in 
attendance, and to students currently in 
attendance at the LEA of their rights 
under this part. 

(b) The notice must state that parents 
and students have the rights listed in 

§ 98. z. 

(c) As used in paragraph (a) of this 
section, effective notice means a notice 
that is reasonably likely to inform 
parents and students, including those 
with disabilities and those whose 
primary or home language is not 
English, of their rights. 

(Authority: 20 U.S.C. 1232h(c)) 

Subpart E— Enforcement 

§98.40 What are the functions of the 
Family Policy Compliance Office (Office) 
and the Office of Administrative Law 
Judges? 

(a) The Family Policy Compliance 
Office (Office) — 

(1) Investigates, processes, and 
reviews complaints of violations under 
this part; and 

(2) Provides technical assistance to 
ensure compliance with this part. 

(b) The Office of Administrative Law 
Judges has jurisdiction to conduct the 
following proceedings to enforce the 
requirements in this part — 

(1) Hearings for recovery of funds. 

(2) Withholding hearings. 

(3) Termination hearings. 

(4) Cease and desist hearings. 

(Authority: 20 U.S.C. 1232h(e)) 

§ 98.41 What are an SEA’s and LEA’S 
responsibilities in the case of a conflict with 
State or local laws? 

If an SEA or LEA determines that it 
cannot comply with any of the 
requirements of this part due to a 
conflict with State or local laws, it shall 
notify the Office within 45 days, giving 
the text and citation of the conflicting 
law. 
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(Authority: 20 U.S.C. 1232h) 

§ 98.42 What information must an SEA, 
LEA, or other recipient submit to the 
Office? 

The Office may require an SEA, LEA, 
or other recipient to submit reports 
containing information necessary — 

(a) To resolve complaints under this 
part, including information regarding 
the source of funding for the survey; and 

(b) To ensure that SEAs, LEAs, or 
other recipients are complying with the 
statute. 

(Authority: 20 U.S.C. 1232h) 

§ 98.43 Where are complaints filed? 

A parent or student, as appropriate 
under § 98.44(a), may file a written 
complaint with the Office regarding an 
alleged violation under this part. The 
Office’s address is: Family Policy 
Compliance Office, U.S. Department of 
Education, 600 Independence Avenue, 
SW., FOB-10, room 1366, Washington, 
D.C. 20202-4605. 

(Authority: 20 U.S.C. 1232h(d)) 

§ 98.44 What is the complaint procedure? 

(a) (1) A parent may file a complaint 
under this part for alleged violations of 
the parent’s rights of access, consent, or 
to be notified of the parent’s rights 
under §§98.10, 98.20, and 98.30. 

(2) A student who is an emancipated 
minor or an adult may file a complaint 
under this part for alleged violations of 
the student’s rights to consent or to be 
notified of the student’s rights under 
§§98.20 and 98.30. 

(b) A complaint filed under §98.43 
must contain specific allegations of fact 
giving reasonable cause to believe that 
a violation of this part has occurred. 

(c) The Office investigates each timely 
complaint to determine whether the 
SEA, LEA, or other recipient has failed 
to comply with the provisions of this 
part. 

(d) (1) For purposes of this section, a 
timely complaint is an allegation of a 



violation of this part that is submitted 
to the Office within 180 days of— 

(1) The date of the alleged violation; 
or 

(ii) The date that the complainant 
knew or reasonably should have known 
of the alleged violation. 

(2) The Office may extend the time 
limit in this section if the complainant 
shows that he or she was prevented by 
circumstances beyond the 
complainant’s control from submitting 
the matter within the time limit, or for 
other reasons considered sufficient by 
the Office. 

(Authority: 20 U.S.C. 1232h(d)) 

§ 98.45 What is the content of the notice of 
complaint issued by the Office? 

(a) The Office notifies the 
complainant and the SEA, LEA, or other 
recipient in writing if it initiates an 
investigation of a complaint under 

§ 98.46(b). The notice to the SEA, LEA, 
or other recipient — 

(1) Includes the substance of the 
alleged violation; and 

(2) Requests that the SEA, LEA, or 
other recipient submit a written 
response to the complaint. 

(b) The Office notifies the 
complainant if it does not initiate an 
investigation of a complaint because the 
complaint fails to meet the requirements 
of § 98.44. 

(Authority: 20 U.S.C. 1232h(d)) 

§ 98.46 What are the responsibilities of the 
Office in the enforcement process? 

(a) The Office reviews the complaint 
and response and may permit the 
parties to submit further written or oral 
arguments or information. 

(b) Following its investigation, the 
Office provides to the complainant and 
the SEA, LEA, or other recipient written 
notice of its findings and the basis for 
its findings. 

(c) If the Office finds that the SEA, 
LEA, or other recipient has not 
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complied with this part, the notice 
under paragraph (b) of this section— 

(1) Includes a statement of the specific 
steps that the SEA, LEA, or other 
recipient must take to comply; and 

(2) Provides a reasonable period of 
time, given all the circumstances of the 
case, during which the SEA, LEA, or 
other recipient may comply voluntarily. 

(Authority: 20 U.S.C. 1232h(d)) 

§ 98.47 How does the Office enforce 
decisions? 

(a) If the SEA, LEA, or other recipient 
other than a contractor does not comply 
during the period of time set under 

§ 98.46(c)(2), the Office may, in 
accordance with part D of the General 
Education Provisions Act — 

(1) Withhold, recover, or terminate 
funds under 34 CFR 81.3; or 

(2) Issue a complaint to compel 
compliance through a cease-and-desist 
order under 34 CFR 81.3. 

(b) If a contractor does not comply 
during the period of time set under 

§ 98.13(c)(2), the Office may direct the 
contracting officer to take an 
appropriate action authorized under the 
Federal Acquisition Regulation, 
including either — 

(1) Issuing a notice to suspend 
operations under 48 CFR 12.5; or 

(2) Issuing a notice to terminate for 
default, either in whole or in part under 
48 CFR 49.102. 

(c) If, after an investigation under 
§ 98.44(c), the Secretary finds that an 
SEA, LEA, or other recipient has 
complied voluntarily with this part, the 
Secretary provides the complainant and 
the SEA, LEA, or other recipient written 
notice of the decision and the basis for 
the decision. 

(Authority: 20 U.S.C. 1232h(d)) 

[FR Doc. 95-21227 Filed 8-25-95; 8:45 ami 
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SECTION SUMMARY 

Section 1. A Primer for Privacy 



A. Principles Underlying Privacy Protections 

• Strong federal statutes protect the privacy rights 
of students and their families. These statutes 
encompass education records kept in electronic 
and paper media. 

• Agency and school personnel are legally and 
ethically obliged to safeguard the confidentiality 
of student data. 

• To understand the concept of information privacy, 
you can apply a short set of principles for provid- 
ing and using personal information. 

B. Key Concepts of Privacy Laws and 
Confidentiality Policies 

• Federal and state privacy statutes pertaining to 
students build on the concepts of common law 
and constitutional provisions that imply privacy 
guarantees. 

• The underlying important concepts include notifi- 
cation , disclosure , and informed consent. 



C. Important Terms 

• An education record is a compilation of records, 
files, documents, and other materials that contain 
information directly related to a student and main- 
tained by education agencies or institutions, or 
by individuals acting on behalf of the agencies. 

• Confidentiality refers to your obligation not to dis- 
close or transmit information to unauthorized par- 
ties. 

• Privacy reflects an individual's freedom from intru- 
sion. 

• Security refers to technical procedures which 
ensure that only the authorized and intended par- 
ties have access to data. 

• Disclosure includes permitting access to, reveal- 
ing, releasing, transferring, disseminating, or oth- 
erwise communicating all or any part of any indi- 
vidual record orally, in writing, or by electronic 
or any other means to any person or entity. 

• FERPA defines parent as a natural or adoptive 
parent, legal guardian, or an individual acting as 
a parent in the absence of the parent or 
guardian. These rights transfer to eligible students 
when they reach 1 8 or when they attend a post- 
secondary education institution. 

• An agency or school refers to the entity that col- 
lects, maintains, uses, and releases information 
from education records. 
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SECTION SUMMARY 

Section 2. Summary of Key Federal Laws 



A. Privacy- Related Laws That Apply to Agencies 
and Schools 

• Federal privacy laws apply to education agen- 
cies, institutions, and schools that receive federal 
funds from the U.S. Department of Education. 

• The Family Educational Rights and Privacy Act 
establishes the broad privacy protections for edu- 
cation records. 

• The Protection of Pupil Rights Amendment gives 
parents rights to review their child's records. 

• Other federal laws, such as IDEA, affect data 
collection, maintenance, and disclosure proce- 
dures. 

B. Privacy Protecting under FERPA: Responsibilities 
of Agencies and Schools 

• FERPA grants parents, and students over eighteen, 
access to education records and restricts disclo- 
sure of this information without their consent. 

• Districts' written privacy policies ensure the uni- 
form application of FERPA. 

• FERPA protects most information collected by 
schools about students. However, teachers' infor- 
mal notes, records of school-based law enforce- 
ment units, and employment records do not fall 
under the jurisdiction of this law. 

• Directory information of individual students may 
be released without prior consent. However, 
school districts must give public notice of what is 
considered in this category. 

• The U.S. Department of Education does not 
require local education agencies to notify parents 
or eligible students individually of their rights, but 
agencies must provide notice where it is likely to 
be seen. 

• Parents and eligible students may inspect, review, 
and request to amend education records. 

• FERPA restricts release of information without prior 
consent. However, FERPA allows disclosure if offi- 
cials have a legitimate educational interest in 
gaining access to the information. 



• FERPA restricts records matching and redisclosures 
of private information to third parties. It also 
established penalties for inappropriate redisclo- 
sure. 

• In 1996, new provisions clarified FERPA, making 
it easier for school officials to understand the 
laws central requirements. 

C. U.S. Department of Education-Funded Surveys 
and Studies 

• PPRA applies to programs that receive funding 
from the U.S. Department of Education. This law 
requires that schools and contractors obtain writ- 
ten consent from the parents before minor stu- 
dents are required to participate in a survey, 
analysis, or evaluation that reveals certain infor- 
mation. 

• PPRA requires education agencies to establish 
procedures for parents to follow if they believe 
their rights are violated under PPRA. 

D. FERPA and Special Education Records 

• The privacy of special education records is pro- 
tected by FERPA and by the Individuals with 
Disabilities Education Act. 

• Any participating agency or institution that col- 
lects, maintains, or uses personally identifiable 
information about students with disabilities must 
protect the privacy of these special education 
records. 

• Records pertaining to the identification, evalua- 
tion, and educational placement of children with 
disabilities and the free and appropriate public 
education must be available for inspection by 
parents. 

• Agencies must maintain, for public inspection, a 
list of employees who have access to personally 
identifiable information. 

• State and local education agencies must desig- 
nate a person who is trained in privacy protec- 
tion policies and procedures to serve as the cus- 
todian of the special education records of chil- 
dren with disabilities. 
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Other Federal Laws Affecting Information 
Privacy in Schools 

Education records may be protected by laws 
administered simultaneously by other state and 
federal agencies, as well as by the U.S. 
Department of Education. 

The National School Lunch Act of 1994 protects 
the privacy of information that agencies collect 
and from families of children who are eligible to 
receive free or reduced-price meals. 

Confidentiality regulations apply to records of stu- 
dents who receive assistance or treatment under 
laws administered by the federal Substance 
Abuse and Mental Health Services 
Administration. 

The federal Office of Management and Budget 
reviews and approves the federally administered 
questionnaires, surveys, or forms before they are 
to be used by state and local education agen- 
cies and programs that receive federal funds. 



• The Privacy Act of 1974 stipulates allowable 
uses of social security numbers by government 
agencies and gives individuals the right to refuse 
to disclose or use their social security numbers 
except for the purposes defined by the social 
security law. 

F. Resources in Interpreting Federal Laws That 
Protect the Privacy of Education Records 

• Experts in government offices and education 
organizations can assist education agencies in 
protecting the privacy of education records. 
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SECTION SUMMARY 

Section 3. Protecting the Privacy of Individuals 
during the Data Collection Process 



A. Determining the Agency's Student Data Needs 
and Uses 

• Data collectors must justify the need for every 
item of information that in an individual education 
record . 

• Maintaining data efficiently allows data to be 
used for multiple purposes. However, you must 
justify all uses under existing policies inform data 
providers of these uses. 

B. What Information Can Be Requested about 
Students? 

• You should consult state and local laws, policies 
of school boards, and professional ethics in 
deciding what information to collect and main- 
tain about students. 

• Data providers should be informed about why 
the information is collected and if providing such 
information is mandatory. 

• Data collectors should demonstrate that the data 
produced will be of sufficient value, applicability, 
and usefulness to justify the cost and burden of 
collecting them. 

C. Classifying Data Elements or Record Sensitivity 

• Written policies help you to classify the data into 
directory information, transcript information, or 
supplemental information, and to determine how 
you should maintain and release each piece of 
information. 



D. Ensuring Data Integrity and Accuracy 

• When you choose data elements and the proce- 
dures to collect them, you should consider the 
quality of the data. 

E. Assigning and Using Unique Identification 
Codes 

• You can derive unique identification codes by a 
variety of methods (e.g., assigning sequential 
numbers or adopting algorithms to generate 
codes using selected characteristics). 

• Many agencies and schools use social security 
numbers as the identification codes. School may 
ask for social security numbers but cannot require 
them. 

• Using social security numbers may be helpful to 
agencies or schools in maintaining appropriate 
and accurate information about the students. 
However, school officials must protect the num- 
bers from illegal access and unauthorized 
release. 

F. How Long Should Data Be Maintained? 

• In addition to federal and state requirements, 
agencies or schools should establish policies to 
determine the length of time each type of data is 
maintained and how data will be expunged or 
replaced. 
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SECTION SUMMARY 

Section 4. Securing the Privacy 
of Data Maintained 
and Used within an Agency 



A. Management Responsibilities 

• An official designated as the records manager 
should be responsible for keeping individual 
records safe and intact from accidents, unautho- 
rized access, theft, changes, or unintentional 
release. 

B. Defining "Legitimate Educational Interests" 

• It is more practical to establish criteria for deter- 
mining broad categories of positions than to list 
exactly who or what individual positions are con- 
sidered "school officials." 

• While agencies or schools may establish a poli- 
cy to determine what constitutes "legitimate edu- 
cational interest," the decision also may be made 
case-by-case. 

• If you have any questions about whether a 
requestor has a legitimate educational interest, 
ask the records manager not to disclose the infor- 
mation without prior approval from the parents or 
other appropriate officials. 

C. Training Agency Staff 

• All staff should be trained in information security 
as soon as they are hired. You should inform staff 
of what is considered appropriate and inappro- 
priate access to data and use of the information 
within the records. 



D. Professional Ethical Standards 

• Existing professional standards are invaluable 
resources to support policymaking and training. 

E. Research Use within an Agency 

• It is important to determine each time whether the 
staff assigned to conduct the research are trained 
and authorized to access the data. An alternative 
approach is to sidestep the question of security 
by creating a research file deleting the students' 
identifying information. 
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SECTION SUMMARY 

Section 5. Providing Parents Access 
to Their Child’s Record 



A. Notifying Parents of Their Rights 

• Parents should be informed of their rights under 
FERPA, although the actual means of notification 
is the decision of the agency or school. 

B. Providing Access to Individual Records 

• It is important for an agency or school to prepare 
written procedures for handling record requests. 

C. Handling a Parent's Request 

• The agency of school should verify the authentici- 
ty of requests and comply within forty-five days. 

D. Managing the Review 

• A designated official should manage the review 
process. This official can verify the identification 
of the parents, explain the laws, help parents 
understand the record, and refer parents to 
appropriate resources. 

E. Providing Copies or Charging a Fee 

• Agencies or schools may, but are not required to, 
provide copies of the records. 

• If it is not feasible for the parents to review the 
records because of distance, you should provide 
a copy of the record. 



• While agencies or schools are not allowed to 
charge for the search and retrieval of records, 
they may charge for copying time and postage. 

F. Handling Challenges to Record Contents 

• Written procedures can guide parents through 
the process of challenging their child's record. 

The school or district may provide a form to 
streamline the process. 

G. Managing the Hearing Procedures 

• Parents should be notified as soon as a hearing 
is scheduled. The hearing may be presided over 
by an agency or school official, if this person is 
considered a third party. 

• Evidence presented should be documented. The 
decision should be based solely on the evidence 
presented at the hearing. 

• It is important to follow through on the decision of 
the hearing. 
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SECTION SUMMARY 

Section 6. Releasing Information 
Outside an Agency 



A. Types of Information Release 

• Non-personally identifiable data do not reveal 
specific information about an individual. Release 
of this type of data is generally allowed. 

• Personally identifiable data are those that contain 
information that would make the students identity 
and any related information about him or her 
easily recognized. Release of this' type of data is 
subject to established policy in the school district, 
as well as state and federal laws. 

B. Release of Directory Information 

• State and local laws may specify what types of 
information are considered directory information, 
which may be released without prior consent. 
However, parents must be informed of what is 
considered directory information and given the 
opportunity to withhold its release. 

C. Release with Prior Consent 

• Non-directory information can be released with 
written consent from the parent. The consent 
should specify the information that may be 
released, the purpose of the release, and the 
recipient. 

D. Release without Prior Consent 

• Personally identifiable information may be 
released as authorized in established policies 
and federal or state law or regulations. 

• Examples of those to whom information from edu- 
cation records may be released without seeking 
consent from parents include authorized represen- 
tatives from state and local education agencies, 
the juvenile justice system, and health or safety 
personnel in case of an emergency. 

• Information about a students eligibility for free 
and reduced-price school meals may be released 
only as authorized under the NSLA and its regu- 
lations. 

E. Release to Researchers 

• Requests from researchers should be handled 
case-by-case. You should establish a set of crite- 
ria, application procedures, and written guide- 
lines for making the decision. 



F. Release to Other Service Agencies 

• Agencies are developing strategies which estab- 
lish the kinds of privacy standards and proce- 
dures that would ensure the confidentiality of 
information while allowing restricted use of infor- 
mation for specific and pre-approved purposes. 

• Interagency sharing of information from students' 
education records generally requires a signed 
release by parents or eligible students, regardless 
of whether the records originate in schools, 
health centers, and employment or social service 
agencies. 

G. Review Prior to Release 

• As a final security control, a designated official 
could review the compiled data and verify that 
local procedures have been followed, before 
approving the release. 

H. Avoiding Misuse of Information by Non- 
Intended or Secondary Users 

• Recipients should be required to sign an affidavit 
that they will not release any personally identifi- 
able information received. 

I. Document the Release 

• It is important for you to document data releases 
whether or not prior consent was required. This 
information should remain in the record as long 
as you maintain the record. 

J. Ensure the Security of Data in Electronic 
Transmission 

• You should establish policies to cover instances in 
which information may be released through elec- 
tronic means. You can use a variety of methods 
safeguard the data, including encryption and 
passwords, and careful logging of a transfer. 
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Questions Page Number 
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